Endurance Advantage
Framework
Our Team
Engagements
Insights
About
Schedule a free consultation
2013 to 2018
Credit & Enterprise Risk Management

From IT Crisis to Examination-Ready

Community & BaaS
The Challenge

What presented as an IT emergency was a whole-bank problem

The bank was formed in the early 2000s by consolidating a group of smaller rural charters, and had grown toward $1 billion in assets by lending into one of the most active energy-producing regions in the country. That boom was its advantage and, as events showed, its principal risk. Oil and gas exposure ran near 22 to 23 percent of total loans and real estate near 42 to 45 percent. The engagement began as a technology emergency. A poorly executed online banking conversion had produced customer-facing failures. Underneath sat a fragile environment: a single virtualization layer that was one point of failure, primary and backup data centers a few miles apart and neither hardened, cold-standby backups, no multi-factor authentication, and unlocked removable media. An examination was approaching. What presented as an IT problem was a whole-bank problem. Credit administration, loan and deposit operations, the branch network, the call center, finance, and enterprise risk each showed the pattern that accompanies fast growth without a matching investment in discipline. And crossing $1 billion would bring the bank under the internal-control regime of the Federal Deposit Insurance Corporation Improvement Act, requiring management to assess internal control over financial reporting and an auditor to attest to it.

KEY TAKEAWAY

The findings nobody had commissioned The most consequential findings were not in any report the bank had commissioned. Call center agents held unmonitored maintenance access to every account. Roughly 3,400 active debit cards were still linked to closed accounts, which meant replacement cards could be mailed to non-customers. These were the seams between departments, invisible on any single team’s dashboard and visible only to someone looking across the whole institution. An urgent failure is usually the visible edge of a systemic gap.

What Project $1 Billion rebuilt
  • Stabilize, then diagnose, then build. Treating the symptom in isolation leaves the cause in place.
  • Grow into the next regulatory tier on purpose. Preparing controls and reporting ahead of a threshold turns a compliance burden into readiness.
  • Underwriting discipline is a growth enabler. Independent underwriting is what lets a concentrated bank grow without importing the lead lender’s risk judgment.
  • Build the workout framework before you need it. Installed before the downturn, it is what allows orderly grading, reserving, and exit.
  • Make examination readiness a habit. Run annually and each examination becomes a checkpoint rather than an event.
  • Stabilized the environment. An interim technology executive on site, a daily operating cadence, root-cause analysis of the online banking failure, backups moved from cold standby to hot-hot, the virtualization environment hardened, removable media locked down, and formal change and problem management introduced. Stable within weeks.
  • Diagnosed the whole bank. A three-week management diagnostic across loan and deposit operations, credit administration, core systems, infrastructure, the branch franchise, marketing, and cost structure, producing the prioritized work plan that became the program.
  • Built enterprise risk. A standalone function under a new Chief Risk Officer with a direct line to the board, an ERM framework and policy, formal IT, vendor, and compliance risk assessments, and the internal-control documentation, process flowcharts, and risk-and-control matrix that FDICIA would require.
  • Rebuilt credit underwriting. A standardized Credit Approval Presentation with written addendum and consistent spreads, explicit policy exceptions with justification, three named sources of repayment, and a requirement that account officers underwrite purchased participations themselves rather than accept the lead bank’s grade. Participation limits capped syndications at 20 percent and total participations at 40 percent of the portfolio.
  • Built the workout framework before the losses arrived. A nine-point risk-rating scale, a dedicated Special Asset Group so workout specialists rather than originating officers managed exits, a Loan Watch Committee and a Problem Asset Committee reporting to the board, a troubled-debt-restructuring procedure required on any modification of $250,000 or more, and quarterly stress testing on larger credits against stress oil and gas price cases.
  • Centralized the branch network. Uniform operations, training, and controls across a franchise that still ran like the independent rural banks it had been assembled from, consolidated vault and ATM servicing, optimized vault cash, and the exit of an indirect lending business that no longer fit.
  • Ran examination readiness as a habit. A full pre-examination review every year for three years, examination materials assembled across safety and soundness, CRA, BSA, and fair lending, and management supported in preparing its responses.
THE PROCESS

Stabilize first, diagnose second, build third

Endurance Advisory stabilized first, diagnosed second, and built third, in deliberate steps. The resulting program was named Project $1 Billion, for both the growth milestone approaching and the FDICIA obligations it would trigger.

What the engagement covered

IT stabilization, whole-bank diagnostic, ERM and FDICIA build, credit underwriting rebuild, workout framework, branch centralization, annual examination readiness

What held when the energy cycle turned

Cleared on a rebuilt control environment

Outcomes

What held when the energy cycle turned

Allowance built through the downturn

The allowance for loan losses was built from 1.18 percent of loans in late 2014 to 1.64 percent by mid-2015, with $3.2 million of provision booked.

Examinations cleared

A full pre-examination review was run every year for three years, keeping findings contained and turning each examination into a checkpoint.

Follow-on fraud blocked

Fraudulent ACH files were contained. Approximately $414,000 processed before detection and a further $182,000 in later files was blocked.

Capital raise supporting a 9% floor

A Tier 1 leverage target of 9 percent was reset to a floor, backed by a $5 million holding company capital raise.

Explore the Framework
THE SOLUTION

A fragile, fast-grown bank became a governed institution

Every functional area was re-papered with policies, committees, and controls under a single program. FDICIA readiness delivered ahead of the threshold: internal-control documentation, a risk-and-control matrix, and an independent controls assessment. A standalone enterprise risk function established under a new Chief Risk Officer reporting to the board. The allowance was built from 1.18 percent of loans in late 2014 to 1.64 percent by mid-2015, with $3.2 million of provision booked through the downturn. A Tier 1 leverage target of 9 percent was reset to a floor, backed by a $5 million holding company capital raise. Fraudulent ACH payroll files were contained. Approximately $414,000 processed before detection and a further $182,000 in later files was blocked, with a bank-wide ACH positive-pay control established as the immediate compensating control. Core processing was outsourced to hardened data centers, resolving the co-located data center continuity finding and shifting core cost from an asset-size to a transaction-volume basis. A fair lending review of 55 mortgage files found no evidence of disparate treatment.

The findings nobody had commissioned The most consequential findings were not in any report the bank had commissioned. Call center agents held unmonitored maintenance access to every account. Roughly 3,400 active debit cards were still linked to closed accounts, which meant replacement cards could be mailed to non-customers. These were the seams between departments, invisible on any single team’s dashboard and visible only to someone looking across the whole institution. An urgent failure is usually the visible edge of a systemic gap.

Community and regional banks that have grown faster than their control environment, carry concentration in a cyclical industry, or are approaching the $1 billion FDICIA threshold with unresolved governance, credit, and technology risk.

The Approach

Stabilize first, diagnose second, build third

Endurance Advisory stabilized first, diagnosed second, and built third, in deliberate steps. The resulting program was named Project $1 Billion, for both the growth milestone approaching and the FDICIA obligations it would trigger.

Outcomes

What held when the energy cycle turned

Allowance built through the downturn

The allowance for loan losses was built from 1.18 percent of loans in late 2014 to 1.64 percent by mid-2015, with $3.2 million of provision booked.

Examinations cleared

A full pre-examination review was run every year for three years, keeping findings contained and turning each examination into a checkpoint.

Follow-on fraud blocked

Fraudulent ACH files were contained. Approximately $414,000 processed before detection and a further $182,000 in later files was blocked.

Capital raise supporting a 9% floor

A Tier 1 leverage target of 9 percent was reset to a floor, backed by a $5 million holding company capital raise.

Explore the Framework
Get Started

Put these insights to work.

Tak through what you are reading with the practitioners who wrote it.

Schedule a free consultation