Who assigns a loan risk rating, and who can change it

On a commercial loan the lender assigns the risk rating first, and an independent reviewer then validates it or adjusts it. That is not a gap in the rules; it is what the banking agencies' guidance describes, because the officer in frequent contact with a borrower usually sees trouble before anybody else. What makes the arrangement trustworthy is everything bolted to it: who may change a grade, how a disagreement is settled, how long the lender has to answer, and who the reviewer reports to. Credit Risk Review is Botminds' software for the loan review function that has to hold those lines — it suggests a grade from the file, never sets one, routes each disagreement to a reviewer who had no part in the loan, and puts a clock on the lender's answer.

The people, bank and borrower in the worked example are fictional characters in the solution's sample data. The guidance quoted is real, and linked where it appears.

Who assigns the risk rating on a commercial loan?

The lending staff, first. The interagency guidance is direct about it: "an effective framework generally places primary reliance on the lending staff to assign accurate and timely risk ratings and identify emerging loan problems." Those ratings are then reviewed by someone qualified and independent of the lending function — peers, a manager, a loan committee, a dedicated review unit staffed with credit review specialists, or an outside reviewer, depending on the size of the bank.

So the honest answer to the question has two halves. The lender holds the pen on the grade of record. Somebody who had no part in making the loan holds the pen on whether that grade survives. A bank that can only name the first half has an unreviewed rating system, whatever its policy says.

Why the lender rates first, and why that is not a loophole

Proximity. A relationship manager hears that a tenant is leaving, or that a customer is moving volume, months before it reaches a financial statement. The guidance leans on that deliberately, and the FDIC's manual says the same thing from the other side: loan officers are generally responsible for ongoing credit analysis and the prompt identification of emerging problems, because frequent contact lets them see problems first.

The guidance is equally clear about the limits of that reliance. Institutions "should be careful to avoid over-reliance on loan officers and line staff for identification of problem loans", and the OCC's handbook names the reason without euphemism: the closeness that gives a lender the most timely information is the same closeness that can compromise their objectivity, and their incentives tend to reward producing loans over rating them accurately. Nobody is accusing anybody. It is a structural observation about what happens when the person who made the loan is also the only person who grades it.

One practical design follows from reading both halves together. The handbook notes that many banks "find risk rating accuracy improves by requiring ratings to be a joint decision of lenders and credit officers (at least one person from each function)" — proximity and independence in the same room, rather than one after the other.

What independence actually means in the guidance

It is defined by two negatives, not by a job title. "An independent assessment of risk is achieved when personnel who perform the loan review do not have control over the loan and are not part of or influenced by individuals associated with the loan approval process." Control, and influence. A reviewer who never touched the credit but reports to the person who approved it fails the second test as surely as one who underwrote it fails the first.

That is also why independence is an assignment problem rather than an organisation-chart problem. The sample bank's review queue checks each loan's approval history before giving it to anyone, keeps reviewers off loans they approved or managed, and adds a cooling-off period — twelve months in its settings — before a reviewer takes loans from a region they used to lend in. Those are configurable because banks differ; what does not vary is that the rule exists in writing and can be shown to have been followed on any given loan.

A review queue in Credit Risk Review, assigned around the approval history

Can a loan officer change a risk rating?

A loan officer can propose a change at any time, and should — the whole point of placing primary reliance on lending staff is that they move a grade the moment they learn something. What a loan officer cannot do is undo an independent reviewer's grade by disagreeing with it. The guidance's default runs the other way.

If credit risk review personnel conclude that a loan or loan portfolio is of a lower credit quality than is perceived by the portfolio management staff, the lower classification or risk rating typically prevails unless internal parties identify additional information sufficient to obtain the concurrence of the independent reviewer or arbiter on the higher credit quality classification or risk rating.

Interagency Guidance on Credit Risk Review Systems, May 2020

Read that sentence carefully, because it is doing precise work. The lower grade prevails by default. It can be displaced — but only by additional information, and only if that information persuades the independent reviewer or the arbiter. A lender's professional disagreement, however experienced, is not additional information. A signed lease, a cure payment, a guarantor's new statement: those are.

The pre-arranged process, and the agencies’ default tie-break

Before that default ever applies, the guidance asks for the route to be agreed in advance: "it is important to resolve risk rating differences between loan officers and loan review personnel according to a pre-arranged process," which "may include formal appeals procedures and arbitration by an independent party or may require default to the assigned classification or risk rating that indicates lower credit quality."

Pre-arranged is the operative word. A bank that decides how to settle a dispute while having one will settle it on seniority, and everybody involved will know that is what happened. Writing the route down in advance — who arbitrates, how long the lender has, what evidence reopens a grade — is what turns a disagreement from a political event into a procedural one.

The challenge as Credit Risk Review drafts it, before a reviewer sends it

What happens when loan review and the lender disagree on a grade?

It goes to the arbiter the policy names, with both write-ups and the evidence each rests on. At the sample bank that is the chief credit officer; the alternative in its settings is the credit committee, and either is defensible as long as the seat is independent of the loan and the choice is written down before it is needed.

What matters more than the destination is what travels with the dispute. A grade argument conducted in email is a contest of assertions. The same argument with the recomputed covenant, the note in the interim statements, the customer's notice letter and the lender's own reply attached is a question of fact that usually answers itself. In the worked example the lender agreed with the downgrade within two minutes of reading it, and said why: he had known about the customer leaving and had expected the borrower's owner to backfill the space, and he had not known about the distributions at all.

The lender’s answer, with the conditions and the activity trail

Does loan review have the final say? The record, and the one-step difference

Two defaults are worth keeping apart, because blurring them is how a policy ends up meaning something different from the guidance it was written against.

The guidance's default is that the lower grade prevails from the moment the independent reviewer reaches it, unless new information changes the reviewer's or arbiter's mind. The sample bank's default is one step gentler: the reviewer sets a review grade immediately, the grade of record changes when the challenge settles, and the loan is carried and reported as under challenge in the meantime. Both appear in the quarter's reporting; neither lets a disputed grade disappear.

The gentler default buys the lender a short, bounded chance to produce facts — which is exactly what the guidance's "unless" clause contemplates — and it costs the clock. That is a trade a bank can make deliberately. What it cannot do is use the delay as a place for a grade to rest indefinitely, which is why the clock and the overdue count exist.

How long does a lender have to answer a grade challenge?

As long as the bank's policy says, and the number should be short enough that the quarter's reporting is not waiting on it. The sample bank gives the lender ten business days, with five and fifteen as the other settings; the challenge is dated when it is sent, the due date is on the lender's screen, and an unanswered challenge turns overdue rather than quietly ageing.

One number is worth watching more than the clock itself: how many challenges are overdue. In the sample quarter, thirteen challenges were with lenders and one had passed its ten-day clock and was marked overdue. A single overdue challenge is a scheduling problem. A column of them is a signal that the review function's findings are not being taken seriously, and it is visible to an examiner in exactly the same way it is visible to the head of loan review.

Who does loan review report to, and why it matters

The board, or a committee of it. The guidance puts it as plainly as supervisory writing gets: "whether or not the institution has a dedicated credit risk review department, it is prudent for the credit risk review function to report directly to the institution's board of directors or a committee thereof, consistent with safety and soundness standards." Senior management may handle administrative matters, provided the arrangement does not compromise independence.

The reporting line is not ceremony. A review function that reports to the chief lending officer can be independent on paper and is not independent in the one moment that counts — the moment it wants to downgrade a large relationship belonging to a profitable team. The underlying standards say the same thing in the language of a rule, requiring an institution to "establish a system of independent, ongoing credit review and appropriate communication to management and to the board of directors."

What the evidence says about leniency when nobody is independent

There is no public dataset of how often a bank's loan reviewers downgrade a lender's grade. There is, however, a natural experiment one level up, and it is instructive. State-chartered US commercial banks are examined alternately by state and federal supervisors on a fixed rotation, which means the same bank is graded by two different sets of eyes with the same information.

Economists at the Chicago and New York Federal Reserve Banks, the University of Chicago and the University of British Columbia used that rotation to measure the difference. "Federal regulators are significantly less lenient," they found, "downgrading supervisory ratings about twice as frequently as state supervisors." Under federal supervisors the same banks reported higher nonperforming and delinquent loans, higher capital ratios and lower returns — and states whose supervision was more lenient relative to the federal benchmark had more bank failures and higher problem-bank rates.

Read with care, that result is not about loan review and does not claim to be. It measures supervisory ratings of whole banks. What it does establish, on real data rather than intuition, is that the identity and incentives of whoever holds the pen change the ratings that come out — and that the more lenient hand is associated with worse outcomes later. That is the case for independence, stated by somebody with no stake in a bank's loan book.

Can the same person approve a loan and review it?

Not if the review is meant to be independent. The first half of the guidance's definition rules it out: a reviewer must not have control over the loan. At a small institution where the same handful of people do everything, the guidance's answer is not to abandon independence but to reach for whoever is left — staff, officers or directors not involved in originating or approving the specific credit, and whose pay does not depend on the grades assigned.

The compensation point is easy to skip and worth keeping. An independent reviewer whose bonus moves with the criticized total has been handed the same conflict in a different pocket. In the sample bank's arrangement the reviewer's independence is tested per loan against the approval history, and a reviewer who decides to keep the lender's grade against the agents' suggestion must write the reason, which goes to internal audit and is listed in the quarter's report — so the easy answer leaves a trace too.

The last row is the one most often misread. Internal audit testing the review function is not a second review function, and a bank that leans on audit to catch mis-grades has put a yearly control where a quarterly one is needed. What audit can do, and the sample bank's arrangement lets it do, is read the whole trail — every suggestion, decision, challenge and answer with who and when — and test whether the process the board approved is the process that ran. Where the grades it is testing came from, and how a rung is argued from a file, is the file review checklist's subject; what the settled grades add up to is the ratio the board is handed.

Questions people ask

Does loan review have the final say on a risk rating?

Usually, in the sense that the agencies' default is for the lower rating to prevail where review and the lender disagree. But that default yields to additional information that persuades the independent reviewer or the arbiter the policy names, so the final say belongs to whoever the bank's written process puts last — commonly the chief credit officer or a credit committee, acting on both write-ups.

Who settles a grade dispute at a bank?

An arbiter named in advance by the credit risk review policy, independent of the loan. The guidance describes formal appeals procedures or arbitration by an independent party as the shapes this takes. What the policy should not do is leave the question open, because an unplanned dispute gets settled on seniority.

Can a loan officer refuse a downgrade?

They can answer it, with reasons, and that is the point of the response window. What they cannot do is leave the grade where it was by declining to engage: the default is that the lower grade stands, and a bank whose grades of record quietly survive unanswered challenges has an independence problem rather than a disagreement.

Who does the loan review function report to?

The board of directors or a committee of it. The interagency guidance calls that prudent whether or not the bank has a dedicated review department, and allows senior management to handle administration provided independence is not compromised. The safety and soundness standards require a system of independent, ongoing credit review with appropriate communication to management and the board.

How do small banks keep loan review independent?

By using whoever is not involved in the specific credit — other officers, directors, an independent committee, or an outside reviewer — and by making sure none of them is paid in a way that moves with the grades assigned. The guidance accepts modified procedures where more robust ones are impractical, provided the board has reasonable confidence the people chosen can review with the needed independence.

Should a reviewer be allowed to keep the lender’s grade?

Yes, as long as the decision is written and visible. A reviewer who agrees with the lender after reading the file has done their job. The arrangement worth insisting on is the one where keeping a grade costs the same effort as changing it — a written reason, on the record, counted in the quarter's report — so that the cheap option is not also the silent one.