Loan review consulting firms exist because the supervisory guidance allows a board to buy the credit risk review function rather than build it, and because, as the FDIC's examination manual puts it, cost and volume may not justify a separate loan review department at a smaller institution. What the guidance does not allow is for the responsibility to travel with the work. That single sentence shapes the whole decision: an engagement is something the board remains answerable for, scopes itself, and has to be able to show an examiner. This guide works through the three ways banks staff the function — a firm, an in-house team, and the hybrid most of them actually run — then through scoping, cost per loan read, and what goes wrong. Botminds' Credit Risk Review is a fourth thing rather than a replacement for any of them, and the section near the end says exactly what it changes and what it does not.
No consulting firm is named, ranked or characterised on this page. Every source here is a regulator, a federal auditor or a federal statistical agency; the sample figures are from the solution's fictional sample bank, Northmere Bank & Trust.
Three ways to staff the credit risk review function
| An outsourced firm | An in-house team | The hybrid | |
|---|---|---|---|
| Independence | Structurally strong: the reviewers have never approved a loan at your bank and have no career inside it. | Depends on design: reporting line to the board, no review of credits the reviewer approved, pay not tied to ratings. | Strong where the firm covers the credits an internal reviewer is conflicted on. |
| Expertise | Broad. The firm sees many banks and many cycles, and its people have usually examined or reviewed for a living. | Deep but narrow. They know your policy, your lenders and your market better than any visitor will. | Both, if the scope is drawn so each side does what it is better at. |
| Coverage | What the fee buys, in visits. Between visits, nothing is being read independently. | Continuous in principle; in practice limited by how long a full file review takes. | Continuous for the internal slice, periodic for the rest. |
| Cost shape | Variable and visible: a fee per visit or per loan, renegotiated each year. | Fixed: salary, benefits, training, and the vacancy risk when the reviewer leaves. | Fixed base plus variable top-up, which is why most boards end up here. |
| What the board still owns | Everything. Responsibility for a sound system does not transfer with the engagement. | Everything, with the added duty to protect the function’s independence internally. | Everything, plus the join: who reads what, and who notices the gap. |
| What it leaves unread | The book between visits, and anything outside the agreed sample. | Whatever the team runs out of hours for, which is usually the smaller end. | Narrower than either alone, but still a sample of a sample. |
Should a bank outsource loan review?
Often yes, and the guidance treats it as a normal choice rather than a concession. The interagency guidance on credit risk review systems lists four ways the assignment of risk ratings by lending personnel is typically reviewed: by "qualified and independent: (i) peers, managers, or loan committee(s); (ii) part-time or full-time employee(s); (iii) internal departments staffed with credit review specialists; or (iv) external credit review consultants". The fourth option sits beside the other three with no caveat attached.
The FDIC's examination manual is blunter about who should expect to be in which category. Larger institutions typically establish separate loan review departments staffed by independent credit analysts, and cost and volume considerations may not justify such a system in a smaller institution, where senior management independent of credit administration, a committee of outside directors, or an outside loan review consultant often fill the role. Whichever is chosen, the manual says loan review personnel should report their findings directly to the board of directors or a board committee.
The decision is therefore not whether an outsourced review is acceptable. It is what the engagement covers, how often it happens, and who is reading the rest of the book in between.
What the guidance lets a board hand to a third party
The work, and not the answer for it. The sentence to put in front of a board before it signs anything:
"The institution's board of directors, or a committee thereof, may outsource the credit risk review function to an independent third party. However, the responsibility for maintaining a sound credit risk review system remains with the institution's board of directors."
Interagency Guidance on Credit Risk Review Systems (SR 20-13), May 2020
The next sentence of the same paragraph is the operational one, and it is usually the part that is not resourced: "In any case, institution personnel who are independent from the lending function typically assess risks, develop the credit risk review plan, and verify appropriate follow-up of findings." Three jobs stay inside the bank even under full outsourcing — assessing where the risk is, writing the plan, and checking that findings were actually fixed — and all three have to be done by someone who is not in lending. A bank that outsources because it has nobody independent available has not solved its problem; it has moved it to the three tasks nobody budgeted for.
The third-party risk guidance the agencies issued in 2023 states the same principle for every outsourced activity: "A banking organization's use of third parties does not diminish its responsibility to meet these requirements to the same extent as if its activities were performed by the banking organization in-house." An engagement is a third-party relationship, which means due diligence on the firm, a contract that specifies the work, and ongoing monitoring of whether the firm is delivering it.
What travels to the firm, and what stays with the bank
The firm can be engaged to do this: Propose a scope and a schedule, and advise on sample design from what it sees at other banks.
This stays inside the bank, under the guidance: Independent bank personnel develop the credit risk review plan; the board or a committee typically approves the scope annually.
The firm can be engaged to do this: Read the files, spread the statements, test the covenants, form a view on each grade.
This stays inside the bank, under the guidance: Nothing, if the engagement is drawn properly. This is the part worth buying.
The firm can be engaged to do this: Recommend a grade and argue it with the lender and with credit administration.
This stays inside the bank, under the guidance: The bank sets the grade of record. A firm’s recommendation is an input to the bank’s process.
The firm can be engaged to do this: Report findings and re-test them at the next visit.
This stays inside the bank, under the guidance: Independent bank personnel verify appropriate follow-up of findings; unresolved items go to senior management and the board.
The firm can be engaged to do this: Write and present it.
This stays inside the bank, under the guidance: The board’s own view of whether the system is sound — which it cannot delegate to the party being judged.
The firm can be engaged to do this: Contractual: scope, quality, timeliness, confidentiality.
This stays inside the bank, under the guidance: Regulatory: the responsibility for maintaining a sound credit risk review system remains with the board.
Can your external auditor do your loan review?
It is not prohibited, and it is flagged. The guidance says only this, in one line: "Outsourcing of the credit risk review function to the institution's external auditor may raise additional independence considerations." The footnote points to the 2003 interagency policy statement on the internal audit function and its outsourcing, which is where the detail lives.
The reasoning is easy to reconstruct. The external auditor forms an opinion on financial statements that include an allowance built on the bank's risk ratings. If the same firm also produced the ratings work the allowance rests on, it is auditing its own output. Add to that the guidance's separate point that credit risk review is not intended to be performed by internal audit, while internal audit retains the ability to audit credit risk review, and the pattern is clear: the agencies want layers that can each test the one below.
In practice banks that use their audit firm's affiliate, or a different partner group, need to be able to explain the arrangement to their audit committee and to an examiner in advance rather than in response to a question. If the explanation is hard to write, that is the answer.
What do loan review consulting firms do, visit by visit
Many engagements run as a few visits a year plus a report cycle. The shape is consistent enough to describe without naming anyone. Before the visit the firm agrees a sample with credit administration — loans above a size threshold, the watch list, insider credits, a slice of new originations and a slice of a chosen segment. It requests files, which is usually the slowest part and the part that determines whether the visit is any good.
During the visit, reviewers read relationships and write a line sheet for each: the facility structure, the current financial picture, covenant compliance, collateral and guarantor support, and a recommended grade with the reasons. Disputed grades are discussed with the relationship manager and credit administration in an exit meeting. After the visit the firm issues a report: loans reviewed, grades recommended and agreed, documentation and policy exceptions, and themes.
What the guidance expects from the frequency is worth holding against that calendar. Significant loans are expected to be reviewed "typically annually, on renewal, or more frequently when internal or external factors indicate a potential for deteriorating credit quality", and results are typically given to the board or appropriate committee quarterly. Two visits a year satisfies the first on the loans in the sample. The second half of the sentence — more frequently when factors indicate deterioration — is the part a visit schedule cannot satisfy on its own, because a schedule set in January does not know what will deteriorate in June.
How much does an outsourced loan review cost?
There is no published figure, and any number quoted without a scope attached is meaningless. Firms price by loans reviewed, by day rate, or as a fixed annual fee for an agreed programme, and the same bank can receive proposals far apart in price because one reads a full relationship and another reads a line sheet. The only number that compares two proposals is the cost per loan actually read, with the bank's own hours included.
Cost per loan actually read — the arithmetic to run on every proposal
The firm’s fee
annual fee, or day rate × days
Include travel and the report, and pin down what a re-test of last year’s findings costs: it is often extra.
The proposal
Your own hours
hours × fully loaded hourly cost
Pulling files, answering questions, attending exit meetings, writing management responses, verifying follow-up. Count them per visit; they are the cost most often left out.
Credit administration and the independent reviewer
Loans actually read
relationships reviewed in full, not files sampled
Ask for last year’s count at a comparable bank, and ask what counts as read.
The engagement scope
Cost per loan read
(fee + internal hours) ÷ loans read
Then the two numbers the board actually wants: cost per million of commitments reviewed, and the share of the book that got no independent read at all.
You, before the board meeting
Two traps in that arithmetic. The first is counting files rather than relationships: a borrower with six facilities can be reported as six loans reviewed or as one relationship read, and the difference changes the cost per loan by a factor of six without changing the work. The second is ignoring the internal hours entirely, which flatters outsourcing and is a common error in these business cases.
What should be in a loan review engagement scope?
The supervisory guidance already supplies the headings. An engagement letter that follows them is easier to defend to an examiner than one organised around the firm's own service descriptions, because a reader can map each clause to the expectation it satisfies.
The engagement scope, clause by clause, mapped to the guidance's headings
- Qualifications of the reviewers assigned
Named people, their credit experience and training, and your right to be told when they change. The guidance expects expertise to match the complexity of the portfolios being reviewed.
- Independence, stated and tested
That no reviewer assigned to your engagement has a relationship with a borrower or a lender here, and that the firm tells you if one arises.
- Frequency, and the trigger for an extra look
Visits per year, and what makes one happen sooner: a rating migration, a concentration, a segment going wrong. A schedule without a trigger cannot meet the expectation of more frequent review when factors indicate deterioration.
- Scope: the risk-based sample, in writing
Size threshold, watch list, insiders, affiliates, new products, rapid-growth segments, past due, nonaccrual, renewed and restructured, previously classified, and a sufficient sample of smaller and newer loans.
- Depth: what a review of one relationship includes
Whether statements are spread on the credit agreement’s definitions, whether covenants are recomputed against the certificate, whether lien perfection and approvals are tested, and whether the grade itself is challenged.
- Findings, follow-up and re-test
How findings are reported, what time frames corrective actions carry, who verifies them — the guidance says independent bank personnel — and whether re-test is inside the fee.
- Communication and distribution
A list of loans reviewed with review dates and the analysis supporting each grade; results to the board or its committee quarterly; who else may read the report.
- Working papers, data and exit
That the bank owns the line sheets and supporting analysis, in a readable form, and gets them on request and at termination. Reports in a firm’s portal are evidence you may lose.
- Third-party risk clauses
Confidentiality, data location and handling, subcontracting, insurance, breach notification, and your right to monitor performance — the 2023 guidance expects all of these for any third-party relationship.
What goes wrong with outsourced loan review
Three failures recur, and federal auditors have documented each of them. Reviewing a 2015 failure, the FDIC's inspector general recorded that the bank's external loan review had run at irregular intervals and lacked depth: it reported documentation, credit policy and financial statement exceptions rather than the credit quality of each relationship (FDIC OIG, AUD-15-006).
Inconsistent frequency is the first. An engagement that slips from three visits to two to one, usually for budget reasons, is rarely re-presented to the board as a reduction in the control.
Depth is the second, and it is the one to test in a proposal. A review that reports documentation exceptions, policy exceptions and statement exceptions is doing real work and is not testing the grade. Ask a firm directly: of the relationships you read at a comparable bank last year, on how many did you recommend a different grade from the one the bank had assigned, and in which direction? A firm that cannot answer is selling a documentation review.
The third is findings that do not reach anyone who can act. In another failure the same decade, examiners found that only one written loan review report had been provided to a bank in a year, although quarterly reviews had been conducted under an outsourcing arrangement — and the one report that surfaced turned up in the examiners' own work papers. The contract had been performed. The control had not. What material loss reviews say about a bank's risk ratings reads four of those reports in full.
The in-house team: what it costs and what it knows
An in-house reviewer costs a salary, benefits, training and the risk of a vacancy, and there is no published median for the role. The nearest measured occupation is the financial examiner, at a median annual wage of $94,160 in 2025; a bank building a business case should start from its own compensation bands and treat that figure as a sanity check rather than a target. Add employer taxes, benefits, training, tools and a share of management time, and the fully loaded cost of one reviewer is substantially above the salary line.
What the money buys that a firm cannot is continuity. An internal reviewer knows which lender is optimistic about absorption rates, which borrower always files late, and which industry in the footprint turned last year. They are also in the building when something happens in March rather than at the next visit in September. Against that, they are harder to keep independent, they can be pulled into deal work when the pipeline is busy, and when they leave the function stops.
The guidance's position on small banks is worth quoting exactly, because it is often read as permission to do less: "Although smaller institutions are not expected to maintain separate loan review departments, it is essential that all institutions have an effective loan review system." No department, but a system — and the system has the same seven elements whoever performs them. What the reviewer's seat actually involves sets out those duties in detail.
The hybrid most banks actually run
Few banks are purely one or the other. The common arrangement is an internal reviewer or a credit administration officer who owns the plan, the follow-up and the board reporting, plus a firm engaged once or twice a year to read a defined sample — typically the largest relationships, the criticized book, and a segment the board is worried about. The firm brings independence where the internal reviewer is conflicted, and a second opinion on the credits that matter most.
The hybrid is also where the join can fail. If the firm reads the large relationships and the internal reviewer reads the watch list, nobody is reading the pass-rated middle of the book, which is where a migration starts. Draw the scope as a map of the whole portfolio with a named owner for every segment, not as two lists of loans, and the hole becomes visible before an examiner finds it.
What changes when the book between visits is read
Here is the third option, stated honestly. It does not replace a firm or an in-house team: the grades still belong to people, and the independent judgment the guidance asks for is still a person's. What changes is the coverage between their visits, and therefore what they spend their visit on.
A year of coverage: a sampled programme and a continuous read, on the same book
The sample plan, as the fictional sample bank ran it in FY2025
- Read once in the year: 312 loans, $1.52B · 39%
- Carries the lender’s grade all year · 61%
Every commercial loan, read every quarter
- Read this quarter: 1,418 loans, $3.86B · 100%
On that sample book the quarterly read produced 91 disagreements with the grade of record, $518.7 million of commitments, 68 of them loans graded more generously than the file supports. Run the same quarter through the old plan and 27 of the 91 would have been reached by the board committee date; the other 64, $329.1 million, would have kept the lender's grade until their annual review. That is the gap a visit schedule cannot close, whoever is doing the visiting.
What a firm or an in-house reviewer opens when the reading is already done
The practical effect on an engagement is that the firm's sample stops being a guess. Instead of agreeing in January which loans look interesting, the scope can be set in October from the loans where the file and the grade actually disagree, ranked by notches times commitment. A firm engaged that way reads fewer loans and finds more, and the proportion of its fee spent reading compliant credits falls.
Coverage, stated the way a board committee can test it
Twelve questions for a firm before you sign
None of these is a trick, and a good firm will answer all twelve without hesitating. The point of asking is that the answers are comparable between proposals, and prices on their own are not.
Twelve questions, in the order a proposal should answer them
- 1. Who will actually be on our engagement, and what have they done?
Names, credit backgrounds, and whether the people in the proposal are the people who will read the files.
- 2. What counts as one loan reviewed?
A facility, a relationship, or a line sheet. Every price comparison depends on this answer.
- 3. Do you spread the statements yourselves, on the credit agreement’s definitions?
Or do you read the bank’s own spread. The second is faster and tests less.
- 4. Do you recompute covenants against the borrower’s compliance certificate?
And do you report a difference where both the certificate and your recomputation pass?
- 5. At a comparable bank last year, on what share of relationships did you recommend a different grade?
In both directions. This is the single most informative number a firm can give you.
- 6. What happens when the lender disagrees with your recommendation?
Who arbitrates, in what time frame, and what your report records when it is unresolved.
- 7. How do you decide the sample, and will you take ours?
The plan is the bank’s to develop under the guidance; a firm that insists on its own sample is taking a duty that is not transferable.
- 8. What triggers an unscheduled visit, and what does it cost?
The guidance expects more frequent review when factors indicate deteriorating credit quality. Price it before you need it.
- 9. Do we own the working papers, and can we export them?
In a readable form, on request and at termination.
- 10. How do you re-test last year’s findings, and is that in the fee?
Follow-up verification stays with independent bank personnel, but the firm should re-test its own findings.
- 11. What do you need from us, in hours?
File retrieval, questions, exit meetings, management responses. Put the number in the business case.
- 12. What do you not do?
The most useful answer in the list, and the one that tells you what the bank still has to cover.
Where this solution fits is the gap questions 7, 8 and 12 keep pointing at. It reads every commercial loan from its file each quarter, ranks the disagreements, and assigns each one to a reviewer who had no part in approving or managing it, with a cooling-off period after a move out of lending. It never changes a grade of record. The firm, or the in-house team, still decides the grades and still owns the opinion the board relies on; what changes is that the loans between their visits have been read, and the sample they read next time is chosen from evidence rather than from a size threshold. To see the queue, the coverage and the board report together, start from Credit Risk Review.
Questions people ask
Can the board delegate responsibility for loan review?
No. The board or a committee may outsource the function to an independent third party, but the guidance states that the responsibility for maintaining a sound credit risk review system remains with the board. The 2023 third-party risk guidance says the same for outsourced activities generally: using a third party does not diminish the banking organization's responsibility to meet its requirements to the same extent as if the work were done in-house.
How often should an outsourced loan review run?
Significant loans are expected to be reviewed typically annually, on renewal, or more frequently when internal or external factors indicate potential deterioration, with results going to the board or appropriate committee quarterly. A few visits a year is a common shape. The harder half of the expectation is the trigger for an extra look, which should be written into the engagement rather than negotiated when something goes wrong.
Can you keep loan review in-house at a small bank?
Yes, with a modified procedure. The guidance accepts an independent committee of outside directors, or qualified staff — including loan officers, other officers or directors — who were not involved in originating or approving the specific credits being assessed and whose compensation is not influenced by the assigned risk ratings. The FDIC's manual adds that smaller institutions are not expected to maintain separate loan review departments, but that every institution needs an effective loan review system; Annual Credit Review's guide to independent loan review at a small bank works through the options.
Who owns the working papers from an outsourced review?
Whoever the contract says, which is why it should say the bank. The guidance expects a list of all loans reviewed, the review date and a summary analysis substantiating each assigned grade. If those live only in the firm's system, the bank's evidence of its own control depends on a vendor relationship continuing, and an examiner asking in a year the engagement has lapsed will be told it is unavailable.
Does an outsourced reviewer's grade become the bank's grade?
Not automatically. The firm recommends; the bank's own process sets the grade of record. The guidance does expect rating differences between lenders and reviewers to be resolved by a pre-arranged process, and notes that where review personnel conclude a loan is of lower credit quality, the lower rating typically prevails unless new information persuades the independent reviewer or arbiter otherwise.
Does this solution replace a loan review firm?
No, and a board should be sceptical of anything that claims to. The independent judgment the guidance asks for is a person's judgment, and this solution never changes a grade of record. What it changes is the shape of the engagement: the book between visits is read, the disagreements are ranked with the evidence behind each one, and the firm's sample can be chosen from what the files actually say. The decision about who reviews is still yours.