2010 to 2011
Credit & Enterprise Risk Management

When Good Controls Arrive Too Late

Community & BaaS
The Challenge

Behind the asset-quality problem sat a hidden one

Bank of Asheville had grown alongside a regional boom in resort, golf, and luxury residential development. When that market broke in the downturn that began in 2008, the loan books of several area banks broke with it. Behind the visible asset-quality problems sat a hidden one. Bank insiders, including the bank’s president, had been drawn into a straw-borrower and loan-kiting scheme tied to a failed luxury development, making loans in the names of nominee borrowers to funnel money to the project and using further loans to keep earlier ones current. Endurance Advisory was engaged to respond to regulatory pressure and rebuild a credit risk function that had failed to contain concentration, underwriting, and exposure problems. The bank was later closed by its state regulator, placed into FDIC receivership in early 2011, and its deposits assumed by an acquiring bank. The insider scheme led to federal criminal convictions. These facts are matters of public record.

What was installed
  • Independence is the control. A credit function that reports into production is not independent.
  • Make total relationship exposure the unit of analysis. Related-party risk is invisible loan by loan.
  • Controls installed after the stress arrives are documentation, not protection.
  • An independent credit function, structured so approvals and reviews could not be controlled by the people originating the loans.
  • Real underwriting and collateral discipline, requiring genuine cash-flow analysis and collateral verification in place of relationship-based approvals.
  • Exposure transparency, making total relationship exposure including related and interdependent borrowers the unit of analysis, so risk that was invisible loan by loan became visible.
  • Problem-asset and board governance, with accelerated independent portfolio review reported directly to the board loan committee.
THE PROCESS

Rebuild four things at once, under regulatory pressure

EAP was engaged to rebuild four things at once.

What the engagement covered

Independent credit function, underwriting and collateral discipline, total relationship exposure reporting, accelerated portfolio review to the board loan committee

What the engagement produced

The engagement that shaped the assessment framework

Outcomes

What the engagement produced

The engagement that shaped the framework

The conclusion drawn here became a foundation of the assessment framework the firm has used on every engagement since.

The control that actually works

A credit function structured so approvals and reviews cannot be controlled by the people originating the loans.

The right unit of analysis

Making total relationship exposure, including related and interdependent borrowers, the unit of analysis surfaced risk that was invisible loan by loan.

The honest finding

The controls installed are precisely the ones designed to detect straw-borrower and related-party fraud. They work only when they exist before the fraud.

THE SOLUTION

This engagement does not end in a save

This engagement does not end in a save. The bank failed and was placed in receivership, and the fraud that set the failure in motion predated the firm’s arrival. The controls installed are precisely the ones designed to detect straw-borrower and related-party fraud. They work only when they exist before the fraud and cannot be overridden by insiders. That conclusion became a foundation of the assessment framework EAP has used on every engagement since.

Controls that insiders can override are not controls The asset-quality numbers described a real estate problem. The deeper problem was that the bank’s own controls could be overridden by the people they were meant to constrain. Fraud committed by insiders does not show up in a loan file the insiders themselves prepared. The only defense is independence and exposure transparency built in advance of the stress, not after it.

Banks with concentration in a single development sector, institutions where credit approval is not independent of production, and boards that cannot see aggregate exposure by relationship.

The Approach

Rebuild four things at once, under regulatory pressure

EAP was engaged to rebuild four things at once.

Outcomes

What the engagement produced

The engagement that shaped the framework

The conclusion drawn here became a foundation of the assessment framework the firm has used on every engagement since.

The control that actually works

A credit function structured so approvals and reviews cannot be controlled by the people originating the loans.

The right unit of analysis

Making total relationship exposure, including related and interdependent borrowers, the unit of analysis surfaced risk that was invisible loan by loan.

The honest finding

The controls installed are precisely the ones designed to detect straw-borrower and related-party fraud. They work only when they exist before the fraud.

Get Started

Put these insights to work.

Tak through what you are reading with the practitioners who wrote it.