Credit risk review, explained.

Independent loan review in plain words: a second reader for every risk grade

One commercial loan grade, from origination to the examiner

1. The lender makes the loan and sets the gradeBrennick Cold Storage is renewed at grade 4, a pass, in November 2025.
2. The lender monitors itQuarterly certificates and statements arrive; the lender visits and writes a call report.
3. Loan review re-reads the file and tests the gradeIndependent of the lender. This is where the add-back and the leaving customer are found, or missed for another year.
4. The board hears the resultsEach quarter: what was reviewed, what changed, what the lenders said, what is still open.
5. Examiners test the grades, and loan review itselfIf the bank's grades prove reliable, examiners can use them. If not, the examiners' grades replace them.

Step 3 is the subject of this guide. The bank, borrower, people and figures in this example are fictional.

Where loan review differs from what newcomers expect

Grade of record, criticized, classified and migration

Fourteen terms are defined in the one-page summary.

The seven jobs the interagency guidance gives a credit risk review system

In shortThe 2020 guidance lists seven objectives for credit risk review. Two carry most of the weight: find loans with weaknesses promptly, and check and correct risk grades. The rest follow: spot trends, test policy and lenders, and give the board and the finance team an objective picture. Lenders, credit administration, internal audit and examiners each share part of the work; loan review is the part independent of the lending decision.

The Interagency Guidance on Credit Risk Review Systems was issued by the OCC, the Federal Reserve, the FDIC and the NCUA in May 2020; the agencies call it "appropriate for all institutions".1,11 It describes a "system", which can sit in one dedicated unit called loan review or be spread across several, so long as the review of each loan is done by people independent of that loan. The guidance names seven things an effective system does.1

Quoted from the 2020 guidance.1

Who else watches a grade, and what each one owns

Loan review is one of several groups that touch a risk grade. The guidance says lenders identify emerging problems first, "because of frequent contact with borrowers", and warns banks "to avoid over-reliance on loan officers and line staff for identification of problem loans".1 Internal audit is a separate line: the guidance says credit risk review "is not intended to be performed by an institution's internal audit function", and that audit "maintains the ability to independently audit the credit risk review function".1

SR 20-13 and the texts around it: what governs loan review as of October 2026

In shortOne text governs loan review: the 2020 interagency guidance, still in force. It sits on the safety and soundness guidelines, which require "independent, ongoing credit risk review". It borrows the substandard, doubtful and loss definitions from a 2013 interagency agreement. Two 2026 texts touch it at the edges: the April model risk guidance, which leaves generative AI to each bank's own governance, and the September proposal to replace the third-party guidance that covers outsourced loan review.

What "typically" means in the 2020 text

The final text says less than the 2019 proposal did. Commenters asked for room, and the agencies rewrote the frequency and reporting lines with the word "typically". The preamble explains: "quarterly reporting of results is a typical practice, but institutions have room to adjust the frequency given their risk profile and consistent with safety and soundness." Reviews less frequent than annual "are typically well supported and reflective of low risk portfolios" and approved by the board.1

A footnote keeps one firm edge: the board should hear "more frequently than quarterly when material adverse trends are noted".1 The preamble also says the guidance "does not establish any requirements or rules, nor does it mandate implementation of a specific system"; the duty to run independent, ongoing credit review comes from the safety and soundness guidelines it rests on.1

Loan review scope and sampling: what a risk-based scope covers, and the 35% to 80% coverage targets banks publish

In shortThe guidance lists eleven kinds of loans a risk-based scope typically includes, from large loans to insiders, and asks for a sample "representative of the portfolio as a whole". It sets no percentage. Banks that publish their targets aim to read 35% to 80% of a portfolio over a year or two, and most choose loans first by size. Dollar coverage and loan-count coverage can differ a lot: a plan that reads 39% of the dollars may read 22% of the loans.

What a risk-based scope typically includes

Paraphrased from the scope list in the 2020 guidance, which adds that the board typically approves the scope each year "or whenever significant interim changes are made".1

The FDIC's own manual makes the same point about its examiners' samples: "There are no established or expected levels of minimum or maximum coverage, or penetration, ratios", and "Ensuring that the appropriate types of loans are in the sample is more meaningful than how much of the overall portfolio is reviewed."2 A bank's coverage target is therefore its own policy choice, and the board approves it as part of the scope.

The targets banks publish

How banks choose which loans

Dollars covered and loans covered are different numbers

A size threshold reads the big loans first, so a plan covers a far larger share of the dollars than of the loans. The fictional bank in this guide's example shows the gap. Its loan review plan for fiscal 2025 read 312 of its 1,418 commercial loans, $1.52 billion of $3.86 billion of commitments: 39% of the dollars and 22% of the loans, about 78 loans a quarter. The other 1,106 loans were graded only by the lenders who made them that year.

By number of loans, the same plan read 312 of 1,418, or 22%.

Neither number is wrong. Dollar coverage tells the board how much exposure someone independent looked at. Loan coverage tells it how many grades went unchecked. A small loan can still move a lot of reserve when it falls to doubtful, and a pattern of small mis-grades from one lender is a finding about that lender. The guidance's call for "a sufficient sample of smaller loans" is there for that reason.1

Special mention vs substandard, criticized vs classified: the four regulatory grades on a nine-grade bank scale

In shortFour grades have regulatory definitions: special mention, substandard, doubtful and loss. Everything better is "pass", and banks split pass into as many grades as they like. A common commercial scale runs 1 to 9: four pass grades, a watch grade, then the four regulatory ones. Special mention counts as criticized; substandard and worse are both criticized and classified, and examiners compare classified totals with capital.

The four definitions, word for word

A nine-grade scale, mapped

Quoted from the FDIC's examination manual.2 The 2013 Uniform Agreement uses the same words for substandard, doubtful and loss, speaking of assets rather than loans and, for doubtful, of "currently existing facts"; it does not define special mention.12

The names of grades 1 to 5 are the fictional bank's; real scales differ in length and wording. The 2020 guidance allows any scale so long as the bank documents how it translates into the regulatory categories.1

How much of the largest loans sits below pass

The agencies' yearly review of shared national credits, loans of $100 million or more held by several banks, is the agencies' only published count of how much of a large book carries criticized grades. In the 2025 review, 8.6% of $6.9 trillion of commitments were rated special mention or classified, down from 9.1%. The agencies said the decline was "primarily due to growth in new commitments rather than an underlying improvement in credit quality", and that leveraged loans made up 81% of the non-pass total.19

Re-testing a grade with numbers: Brennick's coverage falls to 0.84x, and 91 of 1,418 grades leave the diagonal

In shortA reviewer tests a grade by recomputing what the grade rests on, from the source documents and on the loan agreement's own definitions, then asks which definition the facts now meet. Across the book, a migration matrix counts every loan's move from its grade of record to the grade its file supports. Loans on the diagonal need no one's time; loans off it are the work, ranked by how far they moved and how much is at stake.

One loan, worked through

The example from the top of the page. Brennick Cold Storage's compliance certificate for the twelve months to June 30, 2026 reports EBITDA (earnings before interest, taxes, depreciation and amortization) of $4,715,000, takes off $850,000 of capital spending the loans did not finance, and divides the rest by $2,950,000 of debt service: 1.31 times, above the 1.25 minimum in section 7.1 of the credit agreement. The reviewer reads the agreement before the certificate.

Then the grade. Cash flow no longer covers debt service, and the largest customer, 38% of revenue, has given notice that it will move about 40% of its volume in April 2027. That is a weakness that jeopardizes repayment, and it is well defined: it can be measured and dated. The loan meets the substandard definition.

Doubtful goes too far: payments are current, the two buildings are appraised at $24.8 million against $16.58 million outstanding (67% loan-to-value), and the guarantor holds $2.9 million of cash, so collection in full is not "highly questionable and improbable".2 The grade moves from 4 to 7, three notches, from pass straight into classified.

The whole book on one grid

A migration matrix puts each loan's grade of record in a row and the grade its file supports in a column. A loan on the diagonal kept its grade. A loan to the right of the diagonal was graded too generously; to the left, too harshly. Here is the fictional bank's third quarter, with its nine grades grouped into five bands to fit the page.

Fictional example. Within the pass band, 37 loans also moved between grades 1 and 4, 25 of them down and 12 up; the full nine-by-nine matrix appears in Part B. Criticized loans by grade of record: 108; by the file: 124.

Ranking the 91 is the next job. A simple rule weights each disagreement by notches times commitment and puts any move from pass into criticized at the front, because that line changes the watch list, the board report and the reserve. The chart below ranks six of the bank's disagreements that way.

The 1998 Federal Reserve study of large banks found that loan review units "treat only two-grade discrepancies for individual loans as warranting discussion", while "a pattern of one-grade disagreements within a given business unit" could bring "a quick and decisive response".20 A matrix shows both at once: the single loan three notches out, and the lender whose loans sit one notch to the right again and again.

Paperwork-only reviews, CEO oversight and thin staff: the eight loan review weaknesses behind stale grades

In shortGrades drift because the people who set them are optimistic and the people who check them read too few files, too late, or too shallowly. Failure reports name the same weaknesses again and again: reviews that check paperwork instead of credit, reviews overseen by the chief executive, findings that never reach the board, too few reviewers for a growing book, and trust in the bank's own grades once they have looked reliable for a while.

When the examiner's grades replace the bank's

The plainest measure of a grading problem in any failure report comes from Bank of the Commonwealth in Norfolk, Virginia, eleven years before it failed. At its October 2000 examination, "75 percent of the loan classifications represented downgrades from internal risk ratings assigned by the bank", and examiners found loan review "essentially nonexistent".9

The bank hired an outside firm, improved for a while, and by 2002 examiners judged its rating system reliable. Six years later the construction book turned, and classified assets rose from 7% of tier 1 capital and reserves to more than three times that capital in under four years. The bank failed on September 23, 2011, at an estimated cost of $268.3 million to the deposit insurance fund, 27.5% of its assets.9

A study of large banks in 1998 gives the normal picture for comparison. Loan review units there "usually have the final authority to set grades", inspect "only a sample of loans in each line of business" on "a one- to three-year cycle", and change ratings on anywhere from "essentially none to roughly 10 percent of the loans reviewed, except in the wake of large cultural disruptions such as mergers".20

The same study found that sixteen large banks, 36%, put half or more of their rated loans in a single grade.20 A grade that holds half the book cannot say much about the loans inside it.

Material loss reviews, 2009 to 2026: what inspectors general found about grades and loan review at failed banks

In shortOf the reviews published on failures from 2023 to 2025, none of the four largest names loan review among the causes: those banks failed on deposits, securities and governance. The small failures with credit at their center point to stale borrower information and, twice, to fraud that hid weak loans from examiners. The clearest recent finding on grades is a May 2026 review of a Chicago bank that failed in January 2026: examiners "routinely classified" its loans lower than management did. The older reports, 2009 to 2017, name loan review directly.

When a bank failure costs the deposit insurance fund more than $50 million, the supervisor's inspector general must write a material loss review; below that, a shorter failed bank review.

The 2023 to 2025 failures, report by report

Read together, the recent reports say less about loan review than many commentaries suggest, and the guide does not stretch them. Citizens Bank is the clearest credit failure: by June 30, 2023 its trucking loans equaled 310% of tier 1 capital and the allowance and 43% of its portfolio, and the bank "compounded these issues by advancing additional funds to problem borrowers through overdrafts, often in excess of the State's lending limit, and without first obtaining current financial information or conducting proper collateral analysis".21

Lindsay and Santa Anna show the limit of any review that trusts the bank's own records: in both, weak controls let losses sit unrecognized until discrepancies in the books forced them out.24,28

A 2026 report about grades, in so many words

Metropolitan Capital Bank & Trust, a single-office Chicago bank that lent to wealthy individuals, much of it unsecured or secured by private company stock, failed on January 30, 2026, at an estimated cost to the fund of $19.6 million, 8% of its assets.29

The FDIC inspector general's May 2026 review found no reason for a deeper study, and its short account reads like a description of what loan review exists to prevent: "examiners routinely classified sampled assets from the bank's loan portfolio at lower levels than bank management when applying their internal scoring methodology", and management "continued to apply erroneous and overly optimistic risk scoring practices".29

The earlier reports that name loan review

How examiners lean on a bank's loan review, and what makes them stop

In shortBefore an examination, examiners read the bank's internal loan reviews and judge "the historical accuracy" of its grading. If the grades prove "accurate and reliable", examiners can build their report from them and spend their own time on newer loans. If the sample turns up grades the bank missed, examiners widen their sample, and their grades replace the bank's. Loan review's track record decides how much of the exam it saves.

The FDIC's manual is direct about the trade. "If the institution's internal grading system (watch list) is determined to be accurate and reliable, examiners can use the institution's data for preparing the applicable examination report pages and schedules, for determining the overall level of classifications, and for providing supporting comments regarding the quality of the loan portfolio."2

For a stable, well-managed lender, examiners focus "more on newer originations and less on loans that were deemed of satisfactory quality at previous examinations".2 A loan review function that finds the problems first earns the bank a shorter, narrower examination.

The reverse is also written down. If information "indicates weaknesses in underwriting or credit administration practices", examiners should select a larger sample to fully assess the risk areas.2 Loans move from "discuss only" into full review "if management disagrees with the classification, material concerns with credit underwriting or administration practices are identified".2 The manual leaves no doubt that the examiners' own sample needs no fixed size either: "Achieving a specific loan penetration ratio is not to be the driving factor in determining the loan review sample."2

Why a late downgrade reaches reserves and capital, and the commercial delinquency loan reviewers face in 2026

In shortA grade feeds the watch list, the allowance for credit losses, the classified-assets measure examiners hold against capital, and the board's picture of risk. Business loan delinquency at commercial banks rose from 0.97% in early 2023 to 1.33% in early 2026, and commercial real estate delinquency doubled over the same span; modifications have kept some weak loans current. Those are the conditions in which grades drift.

Four places a grade lands

Delinquency has risen since 2023

The FDIC's 2026 risk review adds the detail a loan reviewer cares about. The industry's commercial real estate delinquency ratio "eased" in the second and third quarters of 2025, and at the largest banks "many banks modified loans, which contributed to lower CRE loan PDNA ratios". Modified commercial real estate loans totaled $11.6 billion, 82% of them performing.23

A modified loan that is current can still have a well-defined weakness, and the 2020 guidance puts "renewed, and restructured loans" in the scope of review for that reason.1 The 2023 workout statement draws the line from the other side: a prudent modification to a sound borrower is not classified because it was modified.13

Problem banks, those with a CAMELS composite rating of 4 or 5, numbered 47 at June 30, 2026.33

AI in loan review: what SR 26-2 leaves to each bank's governance, and the grade calls a reviewer keeps

In shortSoftware can do the parts of loan review that take the hours: gather the file, spread the statements, recompute covenants and compare the file with the grade, for every loan. The 2026 model guidance leaves generative AI, and AI that acts on its own, to each bank's own governance. Independence, the lower-grade rule and board responsibility apply to a tool or a vendor exactly as they apply to people. A reviewer still decides whether a weakness is well defined, and owns the grade.

What the 2020 text already says about automation

The guidance asks reviewers to evaluate "the appropriateness of automated underwriting and credit scoring, including prudent use of overrides".1 In its comments the agencies called "forward-looking indicators such as portfolio concentration trends, shifting underwriting standards, and risk rating migrations" consistent with proactive risk management, and left banks to set their own.1 Nothing in the text limits loan review to a sample; it asks for a sample when the whole book cannot be read.

Automation in loan review today

Where people stay in charge

Inside a loan review function today: five roles, six hand-offs, and hours spent building files

In shortThe head of loan review drafts a yearly risk-based plan for the board, reviewers read the scoped files through the year, lenders answer the findings, the chief credit officer settles disputes, and the board hears the results each quarter. Most of a reviewer's time on a file goes to assembling and spreading it, and little to the judgment the job exists for. About a third of institutions in one survey outsource most or all of the work.

Head of loan review, reviewers, lenders, CCO and audit

A loan review manager's average salary was $140,211 in 2025, according to one vendor's benchmark survey.35 Credit analysts, the role many reviewers come from, earned a median of $83,510 a year in 2025.36

From scope plan to board report: a finding's path

A reviewer's hours on one mid-size relationship

In-house department, outside firm or workflow tools for loan review

Brennick Cold Storage, pass 4 to substandard 7: one grade challenge from the migration matrix to the board risk committee

In shortThis is the example from the top of the page, inside the product. On Sunday night six agents re-graded all 1,418 commercial loans from their files. On Monday morning Nora Lindqvist, senior loan review officer, opens the migration matrix, finds the six loans that jump from pass grade 4 to substandard 7, starts the review of the largest, agrees with the suggested grade, and sends the challenge to the lender. He agrees the same morning, and the loan is in the board report ten days before the committee meets.

1

The whole book on one screen

Monday, October 12, 2026. The grade migration matrix sets each loan's second-quarter grade of record (rows) against the grade its file supports in the third quarter (columns). 1,327 loans sit on the diagonal, where the file agrees with the lender. 91 loans, $518.7 million of commitments, sit off it: 68 graded too generously, 23 too harshly.

The dashed lines mark where pass ends. Twenty pass loans, $152.7 million, cross into special mention or worse. One cell is darker than the rest: Pass 4 to Substandard 7, six loans, $53.2 million, the only three-notch jump in the book.

2

The same matrix, through last year's sample plan

One toggle redraws the matrix the way the bank's old method would have seen this quarter. Last year's plan read 312 loans, about 78 a quarter: the large ones, the watch list and a slice of the rest. By the committee date it would have reached 27 of the 91.

The other 64, $329.1 million, would keep the lender's grade until their annual review, including all six in Pass 4 to Substandard 7. Each cell shows how many it would have left unread.

3

One click opens the cell

The rail lists the six loans, each with the reason for the move and the page behind it. Brennick Cold Storage, $17.6 million, heads the list: debt service coverage 0.84x on the agreement's terms against a 1.25x covenant, while the certificate says 1.31x, and its largest customer moves 40% of its volume in April 2027.

None of the six is in last year's plan for this quarter. The next, Corvane Industrial Park, covers its debt 0.91 times since a tenant paying 44% of its rent left in July.

4

"Start review": the case rebuilt from 34 documents

Nora presses Start review. In 1 minute 12 seconds the file assembler gathers the 34-document credit file and flags an appraisal 40 months old; the financial spreader finds the $680,000 add-back without written approval and the $710,000 paid to the members; the covenant tester recomputes eight covenants and finds two breaches; the risk rating assessor reads the approval memo and the call report and suggests 7, Substandard.

The ladder shows the record at 4 and the suggestion at 7, with the reason it stops short of 8: payments are current, the buildings cover the loan at 67% loan-to-value, and the guarantor holds $2.9 million of cash.

5

Agreed, challenged, answered, recorded

Nora reads the cited pages and agrees with 7. The challenge drafter writes the challenge in the bank's format: three reasons with six citations, why not doubtful, and four conditions, among them a new appraisal of both buildings within 60 days and a reservation-of-rights letter. Every line is hers to edit. She sends it to Marcus Hale, the lender, with a response due Monday, October 26, ten business days later.

Marcus answers the same morning: "Agree with 7. I knew about Fernvale but expected Owen to backfill the space … I didn't know about the distributions." Nora records the final grade 7; the grade of record changes, and the allowance team and the watch list are told. Had Marcus disagreed, both write-ups would have gone to Warren Pike, the chief credit officer.

The solution's design target is that every commercial loan is re-graded every quarter, with about half an hour of reviewer time for each disagreement once the file is built, spread and cited. These are targets, to be measured on your own book.

Rating factors, recomputed covenants, the review queue and the board's loan review report on the remaining screens

In shortOne loan is the story. These screens show the rest: the eight rating factors with their evidence, the spread on the agreement's definitions, the covenants recomputed, the challenge as drafted and as answered, the review queue, coverage against last year's plan, the board report, and the bank's own rating scale and rules as settings.

Select any screen to open it larger. The bank, borrowers, people and figures are fictional.

Who sets the grade: six agents build the case, a loan review officer decides, and the chief credit officer settles disputes

In shortEach agent has one job and limits it does not cross. None of them changes a grade of record, sends a challenge or contacts a borrower. A loan review officer sets every review grade and sends every challenge; the lender answers within a clock; a disagreement goes to the chief credit officer with both write-ups. Reviewers are never assigned a loan they approved or managed.

Agents that assemble, spread, test covenants and draft challenges

Reviewer, lender and chief credit officer in a grade challenge

Every agent step, grade decision, challenge and answer is recorded with who, what and when; setting changes are versioned; internal audit can read everything and change nothing. The grade of record changes only when a reviewer records the final grade.

Nora, Adaeze, Warren, Marcus and Lena on the review screens

What loan review software reads from your credit files and core system, and the re-graded book it returns

In shortIt reads the documents your credit files already hold and the loan data in your core system, scores them on your own rating scale and credit policy, and leaves behind a suggested grade for every loan with its reasons cited, a ranked queue, the challenge and answer for each disagreement, and the board report. Your core system stays the system of record for grades.

Imaging, core, origination and spreading links for loan review

For each, check whether it has an API, a file feed, or only screens, and who owns it.

Your grades, names and regulatory mapping stay as they are

Page-cited reasons, the agreement's own terms, the reviewer's call

The price of a grade caught late: unread pass loans, examiner downgrades and reserves a year behind

In shortStart from your own numbers. No regulator or study publishes the hours a loan review file takes, the share of grades loan review changes today, or how much of the industry's commercial book is reviewed each year. A few published figures frame the cost: what a loan review manager is paid, how much of the largest loans sits below pass, and what one failed bank's weak review function preceded.

Reviewer hours and unread pass loans in your own book

The widened examination and the board that hears late

Checking every grade four times a year: what quarterly re-grading could return in reviewer hours and coverage

In shortPut in your own numbers. The calculator compares your loan review today, a share of the book read once a year by hand, with every loan re-graded each quarter and reviewers working only the disagreements. For many banks the case rests on coverage: the cost of each independent grade check falls by an order of magnitude, and every pass loan is checked four times a year.

Every loan every quarter, and reviewer hours moved to judgment

Quarterly re-grading on your loan count and review hours

Try three cases. At 1,400 loans and these defaults, reviewers spend 1,232 hours a year today and 182 on disagreements; after the tool, about $50,000 a year is still to be found in other value. At 4,000 loans the hours released exceed the cost. At 400 loans the tool costs more than the hours it saves, and the case rests entirely on coverage and timing.

Eight questions on coverage, rating scale, files and governance that place your loan review function in a band

In shortPick the answer closest to your function today. Eight questions score 0 to 2; the last is for reflection. The meter adds up your score as you go, and each question says why it matters and what a strong answer sounds like.

Coverage baseline, a parallel quarter, or the whole commercial book

What to ask a loan review software vendor or outside review firm about coverage, grades, independence and proof

In shortAsk every vendor and every outside firm the same questions, us included. The answers show what the review reads, how a grade is reached, whose scale applies, how independence and disputes work, and how you would measure it on your own loans before signing.

We found no published independent test of any loan review tool's grading accuracy, as of October 2026. A parallel quarter on your own book, scored against your own reviewers, is the fairest comparison, and it measures your current process at the same time.

A parallel quarter on one loan segment, scored on four numbers before you commit

In shortMeasure your current review first, then run one quarter of one segment in parallel with your reviewers deciding every grade, then decide with four numbers. Report the result to the committee that approves your scope. None of these steps commits you to a vendor.

1. Measure today: coverage by loans and dollars, hours per file, grades changed by review last year, examiner downgrades at the last exam.
2. Pick one segment of a few hundred loans, with your rating scale, credit policy and spreading template, and agree the data access with vendor management.
3. Re-grade the whole segment from its files, with your reviewers deciding every disagreement and your lenders answering on the normal clock.
4. Compare with your own sample's findings for the same loans: what each found, what each missed, and the false alarms.
5. Decide with four numbers: disagreements your reviewers confirmed, false alarms, reviewer minutes per disagreement, and loans newly criticized.

Confirmed disagreements and loans the sample missed

Loan review questions people ask: coverage percentages, special mention vs substandard, outsourcing and SR 26-2

In shortThe questions loan review teams, credit officers and buyers search for most, each answered on its own.