Commercial Loan Review: In-House vs Outsourced

A bank or credit union may outsource its loan review function to an independent third party, and the regulators say so directly. The 2020 Interagency Guidance on Credit Risk Review Systems states that the board of directors, or a committee thereof, may outsource the credit risk review function to an independent third party, but that the responsibility for maintaining a sound credit risk review system remains with the institution's board. Outsourcing moves the work, not the accountability.

That single sentence is what most of the in-house versus outsourced debate comes down to. You cannot buy your way out of the obligation, so the decision is a practical one about independence, capacity and expertise rather than a compliance loophole. Below is what the guidance actually requires, the three structures US institutions use, and how to pick between them.

What the interagency guidance actually requires

The 2020 Interagency Guidance on Credit Risk Review Systems, issued by the Federal Reserve, FDIC, OCC and NCUA, replaced parts of the 2006 statements and is the document your examiner is working from. It is deliberately not prescriptive. It states that the nature of credit risk review varies based on an institution's size, complexity, loan types, risk profile and risk management framework, and it gives institutions of all sizes room to tailor the function.

Three requirements survive regardless of the structure you choose:

• Independence from the lending function. Reviewers must not have originated or approved the specific credits they assess, and their compensation must not be influenced by the risk ratings they assign.
• Board accountability. The board or a board committee typically approves the scope of credit risk review annually, or whenever significant interim changes are made.
• Institution-side ownership of the plan. Even where the work is outsourced, the guidance says that institution personnel who are independent from the lending function typically assess risks, develop the credit risk review plan, and verify appropriate follow-up of findings.

That third point is the one banks most often get wrong. Hiring a firm does not mean handing over scoping and follow-up too. Someone inside the institution still has to own the plan and confirm findings were acted on.

Can a bank outsource its loan review function?

Yes. The guidance explicitly permits it: the board or a committee thereof may outsource credit risk review to an independent third party, and some or all of the function may be performed by a qualified third party. The board remains responsible for maintaining a sound system. When you engage a firm you also pick up third-party risk management obligations, and the guidance points to the agencies' vendor guidance for that: SR letter 13-19/CA letter 13-21 for Fed-supervised institutions, FIL-44-2008 for the FDIC, OCC Bulletin 2013-29 for national banks, and NCUA letters 01-CU-20 and 07-CU-13 for credit unions.

One caveat is easy to miss. The guidance notes that outsourcing the credit risk review function to the institution's external auditor may raise additional independence considerations. If your audit firm is also pitching loan review, raise that with your audit committee before signing.

Can a loan officer perform loan review at a small bank?

Under a narrow set of conditions, yes. Footnote 6 of the final guidance addresses small or rural institutions with few resources or employees, and allows them to use qualified members of staff, including loan officers, other officers, or directors, provided those people are not involved with originating or approving the specific credits being assessed and their compensation is not influenced by the assigned risk ratings. Management and the board must also have reasonable confidence that those personnel can conduct reviews with the needed independence despite their position within the loan function.

Read that carefully before relying on it. It is not a blanket exemption. It permits modified procedures where more robust ones are impractical, and it still requires credit-by-credit independence. A two-lender shop where each officer reviews the other's files can work. A shop where the chief lender reviews everything cannot. Smaller institutions also have the option of using an independent committee of outside directors.

In-house, outsourced or co-sourced: the three structures

Most US institutions land on one of three models. Larger banks commonly maintain a dedicated credit risk review function; smaller ones more often buy the independence they cannot staff.

Outsourced and co-sourced loan review is priced as an engagement, and the firms in this market do not publish rates. Cost generally scales with the size of the review sample, the complexity of the credits and how often you run a cycle, so the only way to compare is to send the same scope to two or three firms and read the proposals side by side.

How to decide between in-house and outsourced loan review

Four questions settle it for most institutions.

Can you actually achieve independence with the staff you have? If every person qualified to review a commercial credit also originated or approved part of the portfolio, in-house review is not independent, and no reporting line fixes that. This is the single most common reason community banks outsource.

Do you have the specialty expertise your portfolio needs? A generalist reviewer is fine for standard C&I and owner-occupied real estate. Concentrations in construction, agriculture, healthcare or asset-based lending need a reviewer who has underwritten those credits. Buying that expertise for a cycle is usually cheaper than hiring it.

Is your review scope stable or lumpy? Fixed in-house headcount suits steady volume. If your sample spikes after a growth year or an acquisition, a co-sourced arrangement absorbs the peak without leaving you overstaffed afterward.

Who will own scoping and follow-up? The guidance expects independent institution personnel to develop the plan and verify follow-up on findings. If nobody in-house can do that, outsourcing alone will not produce a compliant system, and that gap is what examiners tend to find.

How often should loans be reviewed?

An effective credit risk review system provides for review and evaluation of an institution's significant loans, loan products or groups of loans typically annually, on renewal, or more frequently when internal or external factors indicate a potential for deteriorating credit quality. Reviews performed less frequently than annually are expected to be well supported and reflective of low risk. The board or an appropriate board committee typically approves the review scope annually, and an effective scope is risk-based, commonly covering loans over a predetermined size, higher-risk segments and credits approved as exceptions to policy.

The practical consequence is that the same borrowers come back around on a cycle, and each pass means re-spreading their latest financials to see whether the numbers still support the grade. That work does not go away regardless of who performs the review.

The part that costs the same either way

Whichever model you choose, someone has to re-spread each credit in the sample. Pull the borrower's most recent tax returns and interim financials, rebuild current cash flow, recalculate debt service coverage against the outstanding schedule, and confirm the numbers still support the rating the loan carries. Done by hand that runs an hour or more per credit, and it is identical work whether the person doing it is on your payroll or a firm's.

It is also where sample size gets capped. Review teams routinely scope a smaller sample than they would like because analyst hours, not judgment, are the constraint. If you outsource, you are paying for those hours at an engagement rate; if you keep it in-house, you are paying for them in headcount.

Automating the re-spreading changes that arithmetic. Loan review software that reads the returns, financial statements and bank statements already in the credit file and returns current cash flow, debt service coverage and existing debt lets a reviewer validate a finished spread instead of building one. The judgment, the scoping and the rating decision stay with your team, which is exactly where the guidance puts them. The same analysis layer sits underneath origination too, which is why commercial loan underwriting software and loan review tooling increasingly overlap: both need the borrower's numbers off the documents before anyone can grade the credit.

One recurring friction is the quality of what the borrower hands over. Interim financials frequently arrive as a raw bookkeeping export rather than a real statement, which forces the reviewer to reconstruct the presentation before they can even compare periods. Asking the borrower to produce a proper set of financial statements from their accounting data before the file goes into the sample removes an argument later about which set of numbers the rating was based on.

What a review actually tests

Loan review is not a re-underwrite, though the analysis overlaps heavily. The reviewer confirms the credit is still rated correctly and still performing to its approved terms: cash flow and coverage retested on current figures, global cash flow rebuilt where guarantors carry the deal, collateral and documentation verified, covenant compliance checked, and policy exceptions flagged. The output feeds directly into the risk rating the bank assigns, and by extension into the allowance.

If you are building or refreshing the process, the mechanics of a single pass are worth writing down before you decide who performs it. Our commercial loan review checklist covers what to pull and test on each credit, and the annual review process walks through the recurring cycle that most of these samples are drawn from. For the document a review either validates or contradicts, see what belongs in a commercial loan credit memo.

The short answer

Outsource when you cannot staff genuine independence, when your portfolio needs expertise you do not employ, or when your review volume is too lumpy to justify permanent headcount. Keep it in-house when you have enough scale to fund reviewers who sit outside the lending line and enough portfolio knowledge to make their findings sharper than a visiting firm's. Co-source when both are partly true. In every case, keep scoping and follow-up with independent institution personnel, and remember the board still owns the system no matter whose name is on the report.