A loan file review checklist that tests the grade, not the folder

A loan file review checklist is the work programme an independent reviewer follows through one commercial credit file, and the useful ones are shorter than the usual form and much harder. Two federal lists exist already — the depth-of-review bullets in the interagency guidance on credit risk review systems, and the depth-of-reviews list in the FDIC's examination manual — and they agree almost line for line, which means a bank does not have to invent its own. What they ask for is not a folder audit. Only three of the eleven tests are about the paperwork; the rest ask whether the credit still works, and the last and hardest is whether the grade on it is right. Credit Risk Review is Botminds' software for loan review teams that run those tests on every commercial loan rather than on a yearly sample, rebuilding each case from the documents in the file and citing the page behind every finding.

The relationship followed here is sample data on a fictional bank and borrower — Brennick Cold Storage LLC, a refrigerated warehousing business, and its lender Northmere Bank & Trust. The regulatory material is real and linked where it appears.

What is on a loan file review checklist?

Eleven things, if you take the two published lists together and pull apart the one item that bundles two tests. The interagency guidance lists ten; the FDIC's examination manual lists seven, and all seven reappear in the interagency list in slightly different words. The interagency list's first item joins two separate questions — the quality of the credit and its underwriting, and the borrower's performance against its sources of repayment — and a reviewer has to answer them separately, which makes eleven. Put side by side, they run from the quality of the credit, through the paperwork that makes it enforceable, to the covenants, the loss estimate and finally the grade.

The agencies publish two lists, and they agree

The interagency guidance states what loans selected for review are evaluated for, and the first bullet is the broadest: "credit quality, soundness of underwriting and risk identification, borrower performance, and adequacy of the sources of repayment." Nine more bullets follow, and the last is "the accuracy of risk ratings and the appropriateness and timeliness of the identification of problem loans by loan officers."

The FDIC's manual gives the shorter version in its own words: loan reviews "typically analyze a number of important credit factors, including: Credit quality; Sufficiency of credit and collateral documentation; Proper lien perfection; Proper loan approval; Adherence to loan covenants; Compliance with internal policies and procedures, and applicable laws and regulations; and The accuracy and timeliness of credit grades assigned by loan officers." Same opening, same close. The agreement between the two is the reason a bank's work programme does not need to be invented, and the reason a reviewer can defend it line by line.

Part one: is the file complete and enforceable

The first group of tests — documentation, lien perfection, approvals — is the part most checklists do well, and it is worth being clear about what it is for. The safety and soundness standards set the purpose of loan documentation in one clause: it should "enable the institution to make an informed lending decision and to assess risk, as necessary, on an ongoing basis." Not to satisfy a file audit. To let somebody decide, twice: once at approval, and again every time afterwards.

That framing changes what counts as a finding. A missing insurance certificate on a well-performing loan is a housekeeping item. A missing current financial statement is not, because without it nobody can assess risk on an ongoing basis at all — which is why the stale-statement count is worth tracking as a population, not as a per-file note. In the sample bank's quarter, 47 loans were missing a current statement across the whole commercial book.

Part two: does the money still cover the debt

The second group is where a review stops being an audit. Borrower performance and the adequacy of the sources of repayment mean spreading the statements on the credit agreement's definitions — not the borrower's, and not the ones in last year's spread — and seeing what is left after the deductions the agreement names.

On the sample relationship, revenue for the twelve months to June was $38.9 million, down 5.6% from the prior year, with power costs up 22%. EBITDA as reported was $4.715 million. On the agreement's definition it was $4.035 million, and after unfinanced capital spending and distributions, $2.475 million was left against $2.950 million of debt service. Coverage of 0.84x, down from 1.48x at renewal. Funded debt to EBITDA came to 4.11x against a 4.25x maximum: inside the covenant, and up from 2.66x at renewal.

The spread, on the agreement’s definitions, in Credit Risk Review

How do you check a compliance certificate against the credit agreement?

Line by line, starting from the agreement's definition rather than from the certificate's own arithmetic. Pull the definition of the tested term — consolidated EBITDA, fixed charges, debt service, availability — read every proviso in it, and then rebuild the number from the financial statements. Only after that should you look at what the borrower certified. Reading the certificate first anchors you to its answer, and the differences stop being visible.

Two kinds of difference turn up again and again, and the sample file has one of each. The first is an add-back the agreement does not allow. Note 9 of the borrower's interim statements says the compressors serving one building were replaced at a cost of $680,000, expensed as repairs, and that management considers the cost non-recurring and has added it back in the covenant computation. The agreement allows an add-back for such charges only when they are approved in writing by the bank, and no approval exists anywhere in the 34 documents. The second is a deduction left out: $710,000 was paid to the members during the quarter, it appears in note 6, and the covenant's own definition deducts it.

The result is a certificate that says the borrower is in compliance at 1.31x and a recomputation that says it breached a 1.25x minimum at 0.84x. Neither number is disputed arithmetic; they are answers to two different questions, and only one of them is the question the agreement asks. A reviewer who files the certificate has not tested the covenant.

The same comparison is worth running when both answers pass. A certificate that reports a better number than the agreement allows, on a loan that is comfortably inside its covenants, tells you something about how the borrower prepares its figures — and that is a finding worth writing down before the quarter when it matters.

Part three: the covenants, recomputed rather than read

Adherence to loan agreement covenants is one line on both federal lists and several hours of work in practice, because a mid-size relationship carries financial covenants, reporting covenants and negative covenants, each with its own definition and test date. The sample relationship has eight for the quarter. Two were breached: debt service coverage under section 7.1, and the distributions under section 7.5, which are permitted only while coverage stays at or above 1.35x. Two were tight: funded debt to EBITDA at 4.11x against a 4.25x maximum, and the revolver drawn to 94% of its borrowing base. Three of the eight were certified at a different value from the recomputed one.

Eight covenants in Credit Risk Review, certificate against recomputed

The order of those findings matters for the write-up. A reporting covenant met on time says the borrower is cooperative. A financial covenant breached on the bank's own recomputation says the primary source of repayment has failed, and that is the sentence the grade will turn on. Both fall under adherence to loan covenants on the checklist; they are not the same finding.

When does a criticized loan need a new appraisal?

When the bank cannot otherwise show what the collateral is worth. The interagency appraisal guidelines put the duty rather than a deadline on the bank: "an institution should be able to demonstrate that sufficient information is available to support the current market value of the collateral and the classification of a problem real estate credit." Where it cannot, an examiner may direct it to obtain a new appraisal or evaluation.

An institution should be able to demonstrate that sufficient information is available to support the current market value of the collateral and the classification of a problem real estate credit.

Interagency Appraisal and Evaluation Guidelines, December 2010

The guidelines also say when an existing appraisal can no longer carry a later transaction, and the list is about conditions rather than months: a new appraisal or evaluation is necessary if the originally reported market value has changed due to factors such as the passage of time, the volatility of the local market, changes in the terms and availability of financing, natural disasters, over-supply of competing properties, improvements or lack of maintenance, changes in capitalization rates and lease terms, zoning, or environmental contamination.

Banks turn that into a number because a number is reviewable, and the number is the bank's own. The sample bank's credit policy asks for a new appraisal on a criticized loan when the last one is older than 36 months, and it is a setting rather than a rule of law. On this relationship the June 2023 valuation of both buildings at $24.8 million was 40 months old when the review ran, which is why a new appraisal within 60 days became the first condition on the grade challenge rather than a note for next year.

Part four: the grade itself, and why it is the hard one

Both lists end on the accuracy of risk ratings, and both put it last for the same reason: it is a conclusion drawn from everything above it. The ten tests before it produce facts. This one produces a judgement, it is the one an examiner will test hardest, and it is the one a documentation sweep cannot reach at all.

It is also the test most often answered by restating the grade of record. A review that records "grade 4 confirmed" with no argument underneath it has not tested anything; it has copied. What the test asks is whether the file supports that rung today, which means naming the weakness, saying whether it is potential or well-defined, and saying why the grade is not one rung better and not one rung worse. Which rung the argument lands on, and what each rung requires, is worked through in the guide to the 1–9 rating scale.

The case rebuilt from the file before a reviewer opens it

What a reviewer writes down, and what a reviewer does not

Everything on the checklist generates a note; only some of it belongs in the write-up that goes to the lender. The useful rule is that a finding has to change something — the grade, a condition, the loan's position in the queue, or the bank's view of a policy. A documentation exception that changes nothing is recorded as a documentation exception and counted; the examination rating system counts them as a population too, listing "the volume and nature of credit-documentation exceptions" among the things asset quality is rated on.

What does not belong is the reviewer's second guess at the credit decision. The checklist asks whether the underwriting was sound and whether the assumptions were reasonable — both answerable from the file. It does not ask whether the reviewer would have made the loan. A write-up that drifts into the second kind of comment is the fastest way to lose a lender's attention for the findings that matter, and the lender's answer is part of how a grade gets settled: who may change a grade, and what happens when the two sides disagree, is a separate question with a published answer.

Where the hours go in one mid-size relationship

The reason most checklists stop at the folder is arithmetic. On our estimate of a full-file review of one mid-size commercial relationship done by hand, about four hours go into the file and roughly twenty minutes of that is spent judging the credit. Pulling the memo, agreement, statements and certificates together takes about an hour and a half. Spreading the statements and tax returns takes another one and a quarter. Recomputing the covenants takes half an hour, writing up the grade and the challenge about twenty-five minutes, and judging the credit — the eleventh test, the one both federal lists end on — about twenty.

That split is the argument for automating the first ten tests and none of the eleventh. Nothing in assembling a file, spreading a statement or recomputing a covenant calls for judgement — they call for care, and they consume the hours that judgement needs. The questions worth asking of any tool in this category, and the ones worth refusing to answer in a demo, are set out in the buying guide for loan review software.

What is the difference between a documentation review and a credit review?

A documentation review asks whether the file is complete and enforceable: tests five, six and seven on the list above. A credit review asks whether the credit still works and whether the grade is right: tests one, two, three, four, eight, ten and eleven. Both are on both federal lists, and a programme that quietly becomes only the first is the common failure, because it produces clean findings, finishes on time and never disagrees with anybody.

The tell is in the output. If a quarter's review produced thirty documentation exceptions and no grade changes, the second kind of review did not happen. The population a review is supposed to surface — loans whose grade of record the file no longer supports — is the one an examiner will build independently, and the comparison is not usually flattering.

Questions people ask

What documents should be in a commercial loan file?

At minimum: the approval memo, the credit agreement and every amendment, current audited or reviewed statements plus interims, tax returns where the policy requires them, compliance and borrowing base certificates, appraisals or evaluations, lien searches and filings, insurance, guarantor statements, and the lender's call reports and correspondence. The safety and soundness standards set the test for completeness: the documentation should enable the bank to make an informed lending decision and to assess risk on an ongoing basis.

What is a credit documentation exception?

A required document that is missing, out of date or incomplete against the bank's own policy — a statement past its window, an unfiled lien, a guaranty that was never signed. They are tracked as a population because the examination rating system rates asset quality partly on the volume and nature of credit-documentation exceptions, not on any single file.

How long does a full file review take?

For one mid-size commercial relationship done by hand, roughly four hours on our estimate, of which about twenty minutes is spent judging the credit. Large or complex relationships run far longer, and a documentation-only sweep runs far shorter — which is part of why coverage figures are hard to compare between banks unless you know which kind of review is being counted.

Does a loan review checklist have to be the same for every loan?

No. The guidance describes a risk-based scope, and depth follows scope: a large or deteriorating relationship earns the full eleven tests, while a small performing loan in a homogeneous segment may be reviewed as part of a portfolio segment instead. What should not vary by loan is which tests are skipped quietly. If the programme drops the grade test on some loans, that should be a written decision with a reason.

Who should write the bank’s loan review checklist?

The credit risk review function, approved as part of the written review policy that the board or a board committee typically approves at least annually. Building it from the two published lists rather than from a vendor's form has a practical advantage: every line can be traced to the guidance an examiner is working from.

Should a reviewer recompute a covenant that the borrower certified as met?

Yes, and the sample file shows why. A certificate claiming 1.31x against a 1.25x minimum looked like a pass; recomputed on the agreement's own definition — without an add-back that needed written approval, and with the distributions the definition deducts — it was 0.84x and a breach. A difference between the certified and the recomputed number is worth recording even when both pass, because it tells you how the borrower's figures are prepared.