Risk ratings aren't templated or standardized. The most fundamental problem is not having a standard risk rating model in place. In practice, this may mean that risk ratings are set by the whims of lenders based on perceived risk or past behavior. That may be part of the risk rating, but it doesn't objectively capture or predict future risk. Instead there should be defined risk criteria and thresholds.

Risk rating policy isn't consistently applied. Even credit unions that have a formal risk rating model in place often struggle with its inconsistent application: Some lenders may use it but only for certain members or they don't use the proper templates.

These faults then impact a number of critical functions in the credit union — from accurately pricing the loan, to loan administration and finally to calculating the ALLL.

Why should credit unions care about risk rating?

The short answer is because the NCUA and auditors do. Indeed, in a handbook on credit risk published by the Office of the Comptroller of the Currency, regulators begin by stating:

Credit risk is the primary financial risk in the banking system and exists in virtually all income-producing activities. How a bank selects and manages its credit risk is critically important to its performance over time; indeed, capital depletion through loan losses has been the proximate cause of most institution failures. Identifying and rating credit risk is the essential first step in managing it effectively.

There are also non-regulatory reasons to care about having an effective risk rating process: Risk rating is the primary tool for quantifying and managing, not restricting, risk.

Each credit union has a particular risk appetite — the amount of risk that it is willing to take on given a host of considerations: The desire to grow, the current make-up of the portfolio, their capital cushion and the interest rate and general economic environments. Risk rating is thus not necessarily a means of restricting, but rather calibrating and optimizing risk.

There is another added benefit: With a risk rating, the credit union distills hours of analysis and research into a figure that can be readily compared. By giving every credit a numerical risk rating, credit unions can meaningfully compare the riskiness of one deal to the rest of its portfolio without having to re-analyze spreads and key metrics. In other words:

• It can be tracked over time, to see both the evolution of a single credit
• It allows for portfolio-wide reporting, showing how risk ratings “migrate” through risk levels over time
• It is a consistent and easy way to talk about credit risk throughout the life of the loan, from underwriting to calculating ALLL

In short, credit unions should take their risk rating process seriously not only because their regulators and auditors do, but also because it serves as an efficient management tool to calibrate, track and manage risk.

In today's competitive, low rate environment, where members often have more than one option, accurately gauging risk can make the difference between winning and losing new business. It likewise helps credit unions guard against taking uncompensated risks, accurately calculate their reserves and conduct a comprehensive stress test. This is why risk rating is the “common language” of credit risk management.

Keith Pulling is a credit risk consultant at Sageworks. He can be reached at [email protected].