A bank loan audit is a structured review of how a bank originates, documents, monitors, and reserves against its loans. Federal regulators require an on-site examination of every insured bank at least once every 12 months, with an extended 18-month cycle available only to well-capitalized banks under $3 billion in assets that earned top marks on their last review.1eCFR. 12 CFR 208.64 – Frequency of Examination Whether the review comes from the bank’s own internal team, an outside firm, or a federal examiner, the arc is similar: scope the portfolio, pull loan files, grade credit quality, test compliance, and report what needs to change.
Who Actually Runs the Review
Three different groups examine a bank’s loan portfolio, and they are not interchangeable. The methods overlap; the stakes do not.
Internal audit is the bank’s own department, reporting to the board’s audit committee. It tests whether lending policies are being followed and whether internal controls work as designed. It runs continuously.
Credit risk review is a separate function, sometimes in-house and sometimes outsourced to a specialized firm. It evaluates individual loan quality and validates the risk ratings the bank has assigned. Federal guidance states that credit risk review is not intended to be performed by the internal audit function, though the two can coordinate.2Federal Reserve System. Interagency Guidance on Credit Risk Review Systems
Regulatory examinations come from the OCC, FDIC, or Federal Reserve. Examiners focus on safety and soundness, compliance with federal law, and the accuracy of the bank’s own assessments. Their work feeds into a confidential composite rating scored on a 1-to-5 scale, along with individual scores for capital adequacy, asset quality, management, earnings, liquidity, and sensitivity to market risk.3Board of Governors of the Federal Reserve System. Uniform Financial Institutions Rating System Loan audit results directly influence the asset quality and management components, and a downgrade changes how often the bank is examined, what activities it can pursue, and how much it pays for deposit insurance.
External financial audits by independent accounting firms also touch the loan portfolio, mostly to verify that loss reserves and financial reporting comply with accounting standards. The playbook for preparing is the same across all of them: get the files in order, confirm the risk grades are defensible, make sure the numbers behind the reserve calculations hold up.
The Stages of a Loan Audit
The sequence is predictable across reviewers. Knowing it helps bank staff anticipate what will be asked for and what is really being tested.
Planning and Scoping
The review team defines which loan segments to examine and how deeply. Commercial real estate, construction lending, consumer loans, and specialized portfolios like agricultural lending carry different risk profiles. The team reviews financial reports, prior examination findings, and any recent changes in portfolio size or composition to decide where to focus. Segments that grew rapidly or showed rising delinquencies get the most attention.
Scoping also sets the sample. Examiners will not review every loan. They pull a risk-weighted sample that over-represents larger credits, criticized assets, and loans with characteristics that suggest potential problems.
Fieldwork
For each sampled loan, reviewers examine the credit application, underwriting analysis, appraisals, borrower financial statements, the loan agreement, and any modification or renewal documentation. They compare what is in the file against the bank’s written lending policies to see whether the approval followed the bank’s own rules.
Interviews with loan officers, credit analysts, and senior management are standard. Reviewers want to understand not just what the policy says but how it is applied. A well-written policy that no one follows is worse than a mediocre policy everyone understands, because it signals a breakdown in controls.
Risk Classification
This is the core of the audit. Reviewers evaluate individual loans and assign risk grades reflecting the likelihood of repayment. The OCC considers accurate risk rating among its top supervisory priorities because the ratings drive everything downstream: reserve levels, capital adequacy calculations, and management’s own read on the portfolio.4Office of the Comptroller of the Currency. Comptrollers Handbook – Rating Credit Risk
Reviewers validate the bank’s internal ratings by independently analyzing each sampled loan’s financial data, collateral coverage, and payment history. When a reviewer disagrees with the assigned grade, that disagreement gets documented. In a regulatory exam, it can force the bank to reclassify the loan and increase its reserves. A pattern of overly optimistic internal grading is one of the more serious findings an audit can produce.
Reporting and Follow-Up
The team issues a formal report identifying specific deficiencies, control weaknesses, and compliance gaps, along with recommendations or, in a regulatory context, required corrective actions. Management must respond in writing with a corrective plan, owners, and dates. The review team tracks implementation. In regulatory exams, unresolved findings carry into the next examination and can escalate into formal enforcement if the bank fails to act.
How the Loss Reserve Gets Tested
One of the most scrutinized areas in any loan audit is the bank’s reserve against future losses. Under the Current Expected Credit Losses (CECL) standard — mandatory for all remaining institutions for fiscal years beginning after December 15, 2022 — banks must estimate expected losses over the entire remaining life of each loan at origination, incorporating forward-looking economic forecasts rather than waiting for signs of trouble.5Office of the Comptroller of the Currency. Allowances for Credit Losses Comptrollers Handbook The model front-loads loss recognition and requires banks to project economic conditions over a “reasonable and supportable” forecast period, then revert to historical averages beyond that window.
Examiners evaluate whether the methodology uses appropriate segmentation, reasonable economic assumptions, and defensible reversion techniques. They review model validation reports, quarterly reserve calculations, and any qualitative adjustments management applied. A bank that cannot explain why it chose a particular forecast horizon or why it adjusted model output is going to have a difficult conversation with the examiner.5Office of the Comptroller of the Currency. Allowances for Credit Losses Comptrollers Handbook
What Auditors Usually Find
Certain problems show up again and again across banks of all sizes. If you are preparing for a review, these are the categories most likely to draw criticism.
Documentation Gaps
Missing or incomplete documentation is the single most common finding: unsigned loan agreements, expired borrower financial statements, missing appraisals, collateral records that were never filed. Federal safety and soundness standards require loan documentation that enables the bank to make informed credit decisions, assess ongoing risk, and legally enforce its claim against a borrower.6eCFR. 12 CFR Part 30 – Safety and Soundness Standards The fix is straightforward but tedious. Someone has to audit the files before the auditors do.
Weak Underwriting
Examiners look for loans approved despite not meeting the bank’s own credit standards, and for cases where the analysis of the borrower’s ability to repay was thin or missing. Federal standards require underwriting practices that consider the borrower’s overall financial condition, the value of collateral, and the borrower’s character and willingness to repay.6eCFR. 12 CFR Part 30 – Safety and Soundness Standards An exception to policy is not automatically a problem. Banks make exceptions for good reasons. The file needs to document why the exception was justified and who approved it.
Inadequate Monitoring
Approving a loan correctly is only the start. Examiners expect banks to monitor borrowers throughout the life of the loan, especially those carrying higher risk ratings. Common findings include failure to collect updated financial statements, delays in recognizing deteriorating credit quality, and slow downgrades of loans that should have been reclassified months earlier. These monitoring failures directly undermine the accuracy of the bank’s risk ratings and reserve calculations.
Concentration Risk
A bank that lends heavily into a single industry, geographic market, or loan type is exposed to concentration risk. Federal guidelines define a concentration as exposure exceeding 25 percent of the bank’s Tier 1 capital plus its allowance for credit losses.7Office of the Comptroller of the Currency. Comptrollers Handbook – Concentrations of Credit Commercial real estate draws particular scrutiny. Interagency guidance flags banks where construction and land development loans reach 100 percent of total capital, or where total commercial real estate loans hit 300 percent of total capital with growth exceeding 50 percent over the prior three years.8Board of Governors of the Federal Reserve System. Interagency Guidance on Concentrations in Commercial Real Estate Lending Sound Risk Management Practices These are not hard limits, but crossing them guarantees closer regulatory attention.
Fair Lending Violations
Regulators review lending patterns for signs of discrimination prohibited under the Equal Credit Opportunity Act and the Fair Housing Act. The ECOA bars discrimination based on race, color, religion, national origin, sex, marital status, age, or receipt of public assistance income. The Fair Housing Act adds protections for familial status and disability in residential lending.9FFIEC. Interagency Fair Lending Examination Procedures
Examiners analyze Home Mortgage Disclosure Act data, compare outcomes for similarly qualified applicants from different demographic groups, and look for pricing disparities lacking a legitimate business explanation. They pair statistical analysis with file-by-file comparisons of borderline applications where one applicant was approved and a similarly situated applicant from a protected class was denied.9FFIEC. Interagency Fair Lending Examination Procedures Findings in this area carry outsized consequences because they can trigger referrals to the Department of Justice.
Disclosure and Timing Errors
Mortgage lending audits frequently check compliance with the TILA-RESPA Integrated Disclosure rules, which require that borrowers receive a closing disclosure at least three business days before consummation. If certain key terms change after the initial disclosure — the APR becomes inaccurate, the loan product changes, or a prepayment penalty is added — a new three-day waiting period is required.10Consumer Financial Protection Bureau. TILA-RESPA Integrated Disclosure FAQs Banks that routinely close too fast or deliver corrected disclosures late accumulate violations that look bad in aggregate, even when each individual error seems minor.
What Happens After the Findings
Not all findings carry the same weight. Regulators use a graduated system, and the response depends on how serious the deficiency is and whether the bank takes it seriously.
The most common outcome is a Matter Requiring Attention (MRA), a written communication from examiners directing the bank to fix a specific practice. MRAs are not defined in any statute or regulation. They were created by the agencies through internal guidance. They are mandatory, not optional. A bank that receives an MRA is generally expected to develop a detailed remediation plan, have it approved by the regulator, implement it, verify through internal audit that the fix is sustainable, and obtain a final determination from the examiner that the work is complete. A more urgent variant, the Matter Requiring Immediate Attention (MRIA), signals a problem serious enough to demand faster action.
When a bank ignores supervisory findings, or when deficiencies are severe enough on their own, regulators can escalate to formal enforcement. The OCC alone has authority to issue cease and desist orders, civil money penalties, formal agreements with the bank’s board, safety and soundness orders under 12 CFR 30, and orders prohibiting individuals from the banking industry.11Office of the Comptroller of the Currency. Enforcement Action Types The FDIC and Federal Reserve have comparable authority over the institutions they supervise. These actions are public. A consent order posted on a regulator’s website is visible to investors, counterparties, and depositors, and the reputational damage often exceeds the direct financial cost.
What Borrowers Should Know
Loan audits are an internal bank process, but the effects reach borrowers. When a review reveals that a bank has been too aggressive in a particular segment, the bank will typically tighten underwriting for that category. Favorable terms available a year ago may not be available now if an examiner flagged concentration risk in that portfolio.
Auditors or examiners sometimes contact borrowers directly, usually to verify that collateral exists, confirm outstanding balances, or check the accuracy of financial information the borrower provided. This happens most often with large commercial credits or complex financing. It is routine and does not mean anything is wrong with the loan.
If your file is selected for review, the bank may ask for updated financial statements, tax returns, or insurance certificates before examiners arrive. Responding promptly is in your interest. An incomplete file creates a documentation finding that can change how the bank classifies your loan, potentially triggering more restrictive monitoring or an earlier renewal conversation than you expected.
How Banks Get Ready
Institutions that consistently produce clean examinations share a handful of habits. Loan files are reviewed for completeness at origination, at every renewal, and whenever a borrower’s financial statements are collected; waiting until an audit is announced to discover missing documents is a losing strategy. A credit risk review team distinct from the lending staff and the internal audit function validates risk ratings on an ongoing cycle, catching grading drift before examiners do.2Federal Reserve System. Interagency Guidance on Credit Risk Review Systems Prior findings are closed out with documented evidence of remediation, because nothing irritates an examiner more than seeing the same finding repeated. Reserve methodology is documented in detail, covering models, economic assumptions, qualitative adjustments, and the rationale behind each.5Office of the Comptroller of the Currency. Allowances for Credit Losses Comptrollers Handbook Loan officers receive training on current expectations for documentation, underwriting, monitoring, fair lending, and disclosure timing.
The banks that struggle most in audits are usually not the ones with bad loans. They are the ones with bad processes: sloppy files, stale financial data, risk grades nobody updates, reserve models nobody can explain. An examiner can work with a bank that made a few difficult loans and knows it. An examiner has a much harder time with a bank that cannot demonstrate it understands its own portfolio.