This report presents the results of our audit of FDIC examination coverage of underwriting practices for consumer loans not secured by real estate. Such loans are used by consumers to finance a variety of purchases, including: automobiles, appliances, furniture, home repairs, education costs, medical expenses, and vacations.¹ As of March 31, 2008, FDIC-supervised institutions held approximately $94.7 billion in such loans. Accordingly, it is important for FDIC examiners to adequately assess the risks associated with such loans when they represent a material percentage of an institution’s assets.

The audit objective was to assess FDIC risk management examination coverage of institution underwriting practices for consumer loans not secured by real estate. We conducted this performance audit in accordance with generally accepted government auditing standards. Appendix 1 of this report discusses our objective, scope, and methodology in detail.

BACKGROUND

Loan underwriting is the process a lender uses to determine whether the risk of lending to a particular borrower under a particular set of circumstances is acceptable. To help assess the quality of, and the risks associated with, a particular loan, institutions commonly develop underwriting guidelines and use automated or manual credit scoring systems that evaluate creditworthiness on the basis of key attributes of the applicant and other aspects of the transaction.

¹ Consolidated Reports of Condition and Income (Call Report) Schedule RC-C, Item 6 requires FDIC-insured institutions to report “Loans to Individuals for Household, Family, and Other Personal Expenditures (Not Secured by Real Estate).” Item 6.c. Other Consumer Loans includes installment loans, demand loans, and single payment time loans (for purchases as described above). Accordingly, the term “Other Consumer Loans” is also used in this report to refer to such loans.

March 31, 2008 Call Report data showed that out of 5,183 FDIC-supervised institutions, 404 institutions had more than 10 percent of their assets concentrated in consumer loans not secured by real estate (see the table below). For the purpose of this report, concentrations refer to Other Consumer Loan portfolios that total 10 percent or more of the total assets of an institution. We sampled 14 of the 53 institutions for which the FDIC had conducted risk management examinations during 2007 and 2008. Details on our sample are discussed in Appendix 1.

The FDIC’s Division of Supervision and Consumer Protection (DSC) (1) performs risk management examinations of FDIC-supervised institutions to assess their overall financial condition, management practices and policies, and compliance with applicable laws and regulations and (2) issues related guidance to institutions and examiners. DSC has issued underwriting standards to institutions and focuses attention on loan underwriting, including credit scoring, as part of its statutorily required risk management examinations of FDIC-supervised institutions.

Primary examiner guidance on the review of an institution’s consumer credit underwriting practices is contained in DSC’s Risk Management Manual of Examination Policies (Examination Manual), which helps examiners to provide an overall assessment of, and identify the risks associated with, FDIC-supervised institutions’ consumer credit underwriting activities.

Additionally, to aid in monitoring the overall level of risk in institutional lending practices with the emphasis on early risk detection, FDIC policy requires examiners to complete the Underwriting Survey at the conclusion of each on-site risk management examination of an FDIC-supervised institution. Examiners use the online Underwriting Survey Response System to complete the surveys. The FDIC uses the surveys to track whether institutions are making loans without adequate collateral protection and the extent to which the institutions make loans to borrowers who lack a demonstrable ability to repay. The FDIC also uses the surveys to develop reports on trends in risks in current underwriting practices.

RESULTS OF AUDIT

DSC has established sound risk management examination guidance for the reviews of consumer loans not secured by real estate in FDIC-supervised institutions. Specifically, DSC has issued examiner guidance in the form of examination manuals, Regional Directors (RD) Memoranda, Examination Documentation (ED) modules, Financial Institution Letters (FIL),² and FDIC policy statements. Based on our review of 14 examinations, we concluded that the examiners had followed established guidance and conducted procedures as part of risk management examinations to assess consumer loan underwriting risks. Specifically, we found evidence that examiners reviewed indirect lending agreements, underwriting practices, credit scoring systems, the adequacy of allowances for loan and lease losses (ALLL), asset classifications, and risk and account management systems (see Appendix 2). Additionally, examiners conducted transaction testing on a sample of consumer loans when necessary to assess compliance with underwriting standards. For the examinations we sampled, we concluded that the examiners had adequately considered the risks associated with consumer lending activities not secured by real estate (Examiner Assessment of Underwriting Practices for Consumer Loans Not Secured by Real Estate).

Although our overall conclusion was positive with respect to examination coverage of institution underwriting practices for consumer loans not secured by real estate, examiners did not always properly complete the required Underwriting Survey. Specifically, FDIC policy requires that a knowledgeable examiner complete the Underwriting Survey at the conclusion of each examination; however, for 8 (57 percent) of the 14 sampled examinations, the examiners either did not complete the survey (2 cases) or provided responses that were inconsistent with information in the Report of Examination (ROE) on consumer loan underwriting (6 cases). Controls over the Underwriting Survey process were not sufficient to prevent and detect these errors. As a result, this process may not reliably identify trends in the risk associated with underwriting practices for various consumer loans. (Examiner Compliance With Underwriting Survey Requirements).

EXAMINER ASSESSMENT OF UNDERWRITING PRACTICES FOR CONSUMER LOANS NOT SECURED BY REAL ESTATE

DSC’s examination guidance has provided examiners the on-site examination tools to identify and assess consumer lending risk related to: indirect lending agreements, underwriting practices, credit scoring systems, adequacy of ALLL, asset classifications, risk and account management systems, and credit grading systems.

² The FDIC issues FILs to FDIC-supervised institutions to announce, for example, new regulations and policies, new FDIC publications, and a variety of other matters of principal interest to those responsible for operating a bank or savings association. Examiners may consider such institution guidance when conducting risk management examinations.

The Examination Manual includes factors for addressing asset quality, such as the adequacy of underwriting standards, soundness of credit administration practices, and the appropriateness of risk identification practices and credit scoring systems. Further, in general, various other DSC risk management examination guidelines address reviews of transaction testing and analyses of loan portfolios (as described in Appendix 2).

Our review of examination documentation for 14 examinations performed by 5 DSC field offices showed that examiners had followed examination guidance and conducted detailed procedures, such as testing of individual transactions, as part of risk management examinations to assess consumer loan underwriting risks as discussed in the following sections.

Examination Coverage

We sampled 14 of the 53 institutions identified by DSC as having concentrations of consumer loans not secured by real estate to determine the extent of examiner coverage of underwriting standards during on-site risk management examinations. The institutions were engaged in various combinations of consumer lending to include educational and student, home improvement, mobile home, recreational, marine, taxi medallion, subprime automobile, automobile, and indirect lending. Further, examinations for 9 of the 14 institutions indicated concentrations of consumer lending of 20 percent or greater during the period the examination took place.

To determine the level of examination coverage related to consumer credit underwriting for the 14 institutions in our sample, we reviewed ROEs, examination planning documents, examiner working papers and summaries, and DSC’s Virtual Supervisory Information on the Net (ViSION)³ system documentation. The examination for 1 of the institutions focused on a review of the institution’s commercial real estate portfolio, and its consumer lending activities were not addressed in the ROE.⁴ Therefore, our assessment of DSC’s risk management coverage was ultimately limited to the 13 remaining examinations in our sample. Our conclusions on those examinations follow.

• For 13 examinations, the examiners provided substantial coverage of the institutions’ consumer lending activities to include assessments of general policies and procedures, underwriting practices, monitoring systems, and the board of directors’ oversight.
• For 12 examinations, the examiners assessed each of the following: indirect lending programs, ALLL, asset classifications, risk and account management systems, and credit grading systems.

³ ViSION is DSC’s bank-supervision tracking and reporting database.
⁴ The institution had less than 15 percent of is assets concentrated in consumer credits. The examination asset review focused on appraisal and evaluation issues noted at the prior examination. In addition, concentration monitoring was carefully evaluated during the examination given the high levels of commercial real estate and construction and development lending activities at this institution. As of December 31, 2006, commercial real estate loans represented 310 percent of Tier 1 Capital, and construction and land development loans represented 184 percent of Tier 1 Capital.

• For 13 examinations, the examiners considered institution credit scoring. Specifically, evidence for nine of these institutions showed that the examiners conducted reviews of automated credit scoring models, and in four cases, examiners determined that institutions had used manual credit scoring systems that relied on Fair Isaac & Co. (FICO) scores and/or manual scoring methods.

Details of our assessment of the on-site risk management examination coverage of consumer underwriting practices in FDIC-supervised institutions are provided in Appendix 3.

We also assessed the level of transaction testing examiners conducted during the on-site risk management examinations. For 11 of the 13 sampled examinations that addressed consumer lending, examiners conducted transaction testing to measure compliance with consumer lending underwriting standards. Although transaction testing was not conducted for two of the examinations in our sample, we concluded the following:

• For one examination, transaction testing had been conducted during the asset review for the institution 5 months before the on-site examination.
• For one examination, a portfolio-level review had been conducted on the consumer loan portfolio during the on-site examination.

As a result of these generally positive results, we are not making any recommendations related to this finding.

EXAMINER COMPLIANCE WITH UNDERWRITING SURVEY REQUIREMENTS

Based on our sample of 14 institutions that had risk management examinations conducted during 2007, we found that examiners did not always properly complete the required Underwriting Survey. Specifically, FDIC policy requires that a knowledgeable examiner complete the Underwriting Survey at the conclusion of each examination; however, for 8 (57 percent) of the 14 sampled examinations, the examiners either did not complete the survey (2 cases) or provided responses that were inconsistent with information in the ROEs on consumer loan underwriting (6 cases). Controls over the Underwriting Survey were not sufficient to prevent and detect these errors. As a result, the Underwriting Survey process may not reliably identify trends in the risk associated with underwriting practices for various consumer loans. Also, the reports developed from the surveys may not accurately represent the underwriting trends at FDIC-supervised institutions.

The requirement for examiners to complete an Underwriting Survey is contained in RD Memorandum 98-076, Underwriting Survey Questionnaire Changes. The RD Memorandum states that DSC uses examiner responses to the survey to monitor the overall level of risk in banks’ lending practices, with an emphasis on early risk detection of potential lending problems. Additionally, the FDIC’s Division of Insurance and Research (DIR) develops reports from the survey information, showing trends in risk in current practices for various loan types, including consumer loans.

The survey questionnaire requests information about the institution’s underwriting trends since the last examination and the current underwriting practices of the institution examined. The questionnaire focuses on three topics: material changes in underwriting practices for new loans, the degree of risks in underwriting practices, and underwriting practices for specific categories of loans (one of which is consumer loans). The examiners are expected to answer questions related to: (1) the extent to which the institution makes “secured” consumer loans without adequate collateral protection, (2) the extent to which the institution makes consumer loans to borrowers who lack demonstrable ability to repay, and (3) the examiners’ concerns about the institutions’ consumer loan underwriting practices. Examiners are asked to classify the occurrence of specific risky practices as “frequent enough to warrant notice” or, if the risky practice is more prevalent, as “common or standard procedure.”

We reviewed ROEs, Underwriting Surveys, examination planning documents, and asset review summaries for each of the 14 institutions in our sample and found the following:

• For two examinations, the examiners did not complete the Underwriting Survey. According to DSC field office management responsible for the two examinations, one institution was a “niche” bank,5 and one examination was led by the State banking regulators. Neither of these two explanations adequately support why surveys were not completed.
• For two examinations, the examiners completed the Underwriting Survey but did not address questions specifically related to consumer loans.
• For four examinations, the examiners completed the Underwriting Survey, but the responses contained in the survey were contradictory to comments in the respective ROE. Specifically:
  • In two instances, the ROEs indicated the examiners had reviewed the consumer loan portfolio, but the examiners responded in the Underwriting Survey that consumer loans were not reviewed.

⁵ According to DSC Transmittal No. 2004-001, Maximum Efficiency, Risk-focused, Institution Targeted (MERIT) Guidelines, dated January 7, 2004, a niche bank could be any specialized type of bank, such as a credit card or Internet bank.

• In one instance, the ROE indicated the institution had a “loosening of underwriting standards” for consumer loans, while the Underwriting Survey stated the examiner had no concerns with consumer credit underwriting.
• In one instance, the ROE stated the institution had strong consumer loan underwriting standards, while the Underwriting Survey stated the institution made consumer loans to borrowers who lacked a demonstrable ability to repay “frequently enough to warrant notice.”

FDIC management stated it was aware of problems associated with the Underwriting Surveys. According to a DSC management official, there is no required secondary review of the responses to the Underwriting Survey at the field office or regional office level.

In November 2003, DSC conducted a study to investigate (1) the relationships between examiners’ assessments of the riskiness of bankers’ lending practices and subsequent changes in bank condition and (2) the question of whether these relationships can enhance supervisors’ early-warning systems.⁶ According to the study, loan underwriting practices are the primary determinant of bank credit risk and bank credit availability. Specifically, the study found that:

• higher (lower) risk in underwriting practices is associated with subsequent increases (decreases) in nonperforming assets generally,
• assessments of underwriting risk contribute to off-site surveillance models that predict safety and soundness examination ratings, and
• Underwriting Survey data are best used as diagnostic measures of the sources of financial distress.

The FDIC, the Board of Governors of the Federal Reserve System (FRB), and the Office of the Comptroller of the Currency (OCC) conduct surveys on underwriting practices at the banks they supervise and publish the results of the surveys on their Web sites.⁷ In addition, the FDIC’s DIR prepares semiannual reports entitled, Recent Underwriting Surveys by Federal Banking Regulatory Agencies and Recent Underwriting Practices at FDIC-Supervised Banks, based on information provided in the Underwriting Surveys.

⁶ DSC Working Paper 2003-06, Bank Loan-Underwriting Practices: Can Examiners’ Risk Assessments Contribute to Early-Warning Systems?, dated November 2003.

⁷ The FDIC published Perspectives: Recent Underwriting Practices at FDIC-Supervised Banks, dated April 2008 (http://fdic01/division/dir/pubs/Perspectives/2008/underwriting_April_08/NATL.pdf); the FRB published Senior Loan Officer Opinion Survey on Bank Lending Practices, dated April 2008, http://www.federalreserve.gov/boarddocs/snloansurvey); and the OCC published Survey of Credit Underwriting Practices 2008, dated June 2008 (http://www.occ.treas.gov/cusurvey/2008UnderwritingSurvey.pdf).

These reports show trends in risk in current practices for various loan types, including consumer loans.

According to the DIR June 16, 2008 semiannual report on underwriting, the potential risk associated with institutions’ current underwriting practices and the credit risk of institutions’ overall loan portfolios increased compared to the last reporting period. However, the risks in overall underwriting standards were mixed: the frequency of risky practices increased for business, commercial real estate, construction, and consumer lending, but decreased for agricultural and home equity lending.

If examiners do not complete the Underwriting Surveys or respond incorrectly to the questionnaire, the Underwriting Survey process may not accurately identify trends in the risk associated with underwriting practices for various consumer loans and may hamper the efficacy of the survey as an off-site monitoring tool.

When we informed DSC management about our findings in this area, they told us that they were revising the survey process to ensure that the information is more useful. In particular, management plans to obtain more detailed data on institution loan portfolios and implement controls to ensure the completeness and accuracy of survey responses. Such actions can increase the efficacy of the survey as an off-site monitoring tool. Specific information on revisions being made to the survey process, including milestones for implementation, was not available at the completion of our audit. Once implemented, the new survey process could address the deficiencies related to completion of the surveys.

The Director, DSC, should strengthen controls over completion of the Underwriting Surveys to ensure the completeness and reliability of survey information.

CORPORATION COMMENTS AND OIG EVALUATION

On January 29, 2009, the Director, DSC, provided a written response to a draft of this report. In its response, DSC stated that it plans to meet the intent of our recommendation as part of its ongoing revisions to the Underwriting Survey, which will be renamed the Credit and Consumer Products Survey, intended to enhance the quality and quantity of information collected. DSC’s response is presented in its entirety as Appendix 4 of this report.

DSC’s actions are potentially responsive to our recommendation. A summary of management’s response to the recommendation is in Appendix 5 of this report. The recommendation is considered resolved but will remain open until we have determined that agreed-to corrective actions have been completed and are responsive.

Objective

The audit objective was to assess FDIC risk management examination coverage of institution underwriting practices for consumer loans not secured by real estate. Specifically, we assessed the examination coverage of underwriting and credit scoring practices for Other Consumer Loans as included in Call Report Schedule RC-C, Item 6.c.

We conducted this performance audit from June 2008 through October 2008 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.

Scope and Methodology

The scope of our audit involved a review of the FDIC’s guidance issued to institutions and examiners and the FDIC’s process for conducting on-site risk management examinations of FDIC-supervised institutions that have concentrations of Other Consumer Loans.

To obtain an understanding of DSC’s risk management examination coverage of underwriting practices of FDIC-supervised institutions with concentrations of Other Consumer Loans we:

• Identified the various types of institution and examiner guidance and examiner training provided for on-site reviews of Other Consumer Loans portfolios.
• Identified the universe of FDIC-supervised institutions engaged in consumer lending activities and the institutions with consumer loan concentrations.
• Reviewed ROEs, examination planning documents, examination workpapers, and DSC’s ViSION system documentation for our sample of institutions with concentrations of Other Consumer Loans.
• Interviewed appropriate DSC officials in FDIC headquarters, regional, and field offices to obtain their perspectives on consumer lending and overviews of the process they follow when conducting on-site risk management examinations of FDIC-supervised institutions engaged in consumer lending activities.
• Reviewed Call Report data and underwriting trend data related to consumer lending.

Our audit conclusions are based on a non-statistical judgmental sample.⁸ We focused on three categories of institutions with concentrations of Other Consumer Loans. We identified 404 FDIC-supervised institutions that reported over 10 percent of their assets as Other Consumer Loans on their March 2008 Call Reports. We then determined which of these institutions had an FDIC on-site risk management examination in 2007 or 2008. Based on the criteria illustrated below, we identified a universe of 53 institutions.

Out of these 53 institutions, we sampled 14 institutions identified as having various levels of consumer lending activities. The 14 institutions had from 11 percent to 93 percent of their total assets in Other Consumer Loans and were engaged in the following types of consumer lending.

Our sample was ultimately limited to 13 institutions because the examination for 1 of the 14 institutions focused on a review of the institution’s commercial real estate portfolio, and its consumer lending activities were not addressed in the ROE.

⁸ The results of a non-statistical sample cannot be projected to the intended population by standard statistical methods.

To assess the relevant control activities, we identified the processes related to conducting on-site FDIC risk management examinations of institutions’ underwriting practices for consumer loans not secured by real estate. These controls included policies and procedures included in examiner and institution guidance as presented in the DSC Examination Manual, RD Memoranda, ED Modules, FILs, and FDIC Policy Statements.

We identified the following relevant internal controls applicable to examination assessments of consumer credit underwriting and related supervisory and enforcement actions:

• Examination and Institution Guidance: The FDIC has issued examiner guidance for planning and conducting on-site reviews of institutions engaged in consumer lending activities and institution guidance. The guidance addresses, but is not limited to, installment loans, credit underwriting, loan appraisals and classifications, credit scoring, loan review systems, indirect automobile lending, and credit scoring and modeling systems. In addition, DSC has specific procedures for reviews of subprime lending, completion of Underwriting Surveys, and standards for the ROEs and supporting examination workpapers to document the results of the examinations. Also, the FDIC has issued institution guidance (in the form of FILs and FDIC Policy Statements) related to the management of consumer lending portfolios and activities, classification and account management of retail credit, subprime loan portfolios, and management of third-party risk. Examiners may consider such institution guidance when conducting risk management examinations.
• Laws and Regulations: Section 39 of the Federal Deposit Insurance Act - Standards for Safety and Soundness FDIC Rules and Regulations, Part 364, Appendix A - Interagency Guidelines Establishing Standards for Safety and Soundness.
• Oversight and Offsite Monitoring: DSC’s Internal Control and Review Section performs periodic reviews of DSC regional and field office operations. In addition, DSC’s organizational structure provides for supervisory review of examination products such as the Pre-Examination Planning Memorandum.
• Tracking and Monitoring: Call Report Schedule RC-C, Item 6 requires FDIC-insured institutions to report “Loans to Individuals for Household, Family, and Other Personal Expenditures (Not Secured by Real Estate).” Item 6.c. Other Consumer Loans includes installment loans, demand loans, and single-payment time loans. In addition, ViSION’s Supervisory and Reporting Tracking Module records key information on risk management examinations for DSC management.
• Training: DSC has controls in place such as the training and commissioning process for examiners. Additionally, DSC examiners we interviewed stated that DSC’s ED Modules related to consumer lending provided guidance for inexperienced examiners.

Reliance on Computer-processed Information

Our audit objective did not require that we separately assess the reliability of computer-processed information, and we did not rely on computer-processed data to support our significant findings and conclusions. During the audit, we determined that the FDIC tracks the volume of FDIC-supervised institutions with consumer loan concentrations through the Call Report process. Schedule RC-C, Item 6.c. of the Call Report requires FDIC-insured institutions to report the volume of Other Consumer Loans, which include installment loans, demand loans, and single-payment time loans. However, our assessment centered on reviews of ROEs, examination planning documents, examination workpapers and summaries, DIR Underwriting Survey analyses, and ViSION system documentation.

Performance Measurement

We reviewed FDIC annual performance plans and strategic plans to identify goals, objectives, and results and determine whether the Corporation has (1) established quantifiable performance measures and (2) developed and analyzed data to assess program, project, or function performance related to its efforts to identify risk in institutions involved in the underwriting of consumer loans not secured by real estate. In fulfilling its primary supervisory responsibilities, the FDIC pursues two strategic goals: (1) FDIC-supervised institutions are safe and sound, and (2) consumers’ rights are protected and FDIC-supervised institutions invest in their communities. These strategic goals and objectives do not directly relate to on-site risk management examination coverage of underwriting and credit scoring practices for consumer loans not secured by real estate.

In addition, we reviewed the FDIC’s 2005-2010 Strategic Plan, 2008 Annual Performance Plan, 2008 Strategic Priorities, 2008 Corporate Performance Objectives, and 2007 Annual Report, finding no specific information related to our objectives.

Compliance With Laws and Regulations

We reviewed applicable laws and regulations related to the FDIC’s risk management examinations of underwriting practices. We found no instances where the FDIC was not in compliance with applicable laws and regulations, but we did note areas for improvement related to controls over the Underwriting Survey process, as described in the report.

Section 39, Standards for Safety and Soundness, of the Federal Deposit Insurance Act (FDI Act) states that each appropriate federal banking agency shall, for all insured depository institutions, prescribe standards relating to credit underwriting. The Interagency Guidelines Establishing Standards for Safety and Soundness, prescribed pursuant to section 39 of the FDI Act, as set forth in Appendix A to Part 364 of the FDIC Rules and Regulations, applies to all insured state nonmember banks and to state-licensed insured branches of foreign banks that are subject to the provisions of section 39 of the FDI Act.

According to these guidelines, an institution should establish and maintain prudent credit underwriting practices.

We assessed the risk of fraud and abuse related to the audit objective in the course of evaluating audit evidence.

FDIC guidance contains the following examination procedure requirements, which we identified as those that, if conducted during on-site examinations, would provide an overall assessment and identify the risks associated with FDIC-supervised institutions’ consumer lending underwriting and credit scoring activities.

Examination Procedures and Guidance Related to Consumer Loan Underwriting

Based on our review of examination documentation for a sample of 14 FDIC-supervised institutions, we found that examiners generally complied with guidance for assessing consumer underwriting practices during on-site risk management examinations. Although our audit sample contained 14 institutions, during our testing, we found that one institution’s examination focused on commercial real estate and did not address consumer lending. For that one institution, the percentage of consumer loans to total assets was 14.85 percent.

Summary of On-site Risk Management Examination Coverage of
Consumer Lending Underwriting and Credit Scoring Activities in FDIC-Supervised Institutions

APPENDIX 4

CORPORATION COMMENTS

---

This table presents the management response on the recommendation in our report and the status of the recommendation as of the date of report issuance.

APPENDIX 6

ACRONYMS USED IN THE REPORT

---