A bank loan audit is a structured review of how a bank originates, documents, monitors, grades, and reserves against its loans. It can be run by the bank’s own internal auditors, an independent credit risk review team, or federal examiners from the OCC, FDIC, or Federal Reserve, and insured banks must undergo a regulatory on-site examination at least once every 12 months — or every 18 months for well-capitalized banks under $3 billion in assets that earned top marks on their last review.1eCFR. 12 CFR 208.64 – Frequency of Examination Whoever runs it, the review follows the same arc: scope the portfolio, pull loan files, grade credit quality, test compliance, and report what needs to change.
Who Runs the Review
Three different groups look at a bank’s loan portfolio, and the stakes are different for each.
The bank’s internal audit department tests whether lending policies are being followed and whether internal controls work as designed. It reports to the board’s audit committee and operates year-round.
Credit risk review is a separate function. Sometimes it sits in-house, sometimes it is outsourced to a specialized firm, and its job is to evaluate individual loan quality and validate the risk ratings the bank has assigned. Federal guidance explicitly states that credit risk review is not intended to be performed by the internal audit function, though the two can coordinate.2Federal Reserve System. Interagency Guidance on Credit Risk Review Systems
Regulatory examinations are the ones with the sharpest teeth. Examiners from the OCC, FDIC, or Federal Reserve conduct on-site reviews focused on safety and soundness, compliance with federal law, and the accuracy of the bank’s own self-assessments. These examinations feed into a confidential CAMELS rating that directly affects what the bank can and cannot do going forward. A downgrade changes examination frequency, permissible business activities, and even what the bank pays for deposit insurance.
External financial audits by independent accounting firms also touch the loan portfolio, mainly to verify that loan loss reserves and financial reporting comply with accounting standards. The preparation playbook is similar across all four: get the files in order, confirm the risk grades are defensible, and make sure the numbers behind the reserves hold up.
What the Audit Actually Covers
Planning and Scoping
The review team starts by deciding which loan segments to examine and how deeply. Commercial real estate, construction lending, consumer loans, and specialized portfolios like agricultural lending each carry different risk profiles. Reviewers look at the bank’s financial reports, prior examination findings, and any recent changes in portfolio size or composition to decide where to focus. Segments that grew rapidly or showed rising delinquencies almost always get the most attention.
Nobody reviews every loan. Instead, the team pulls a risk-weighted sample that over-represents larger credits, criticized assets, and loans with characteristics that suggest trouble. The sample is designed to support conclusions about the whole portfolio without touching thousands of files.
Fieldwork and File Review
During fieldwork, reviewers dig into the files. For each sampled loan they examine the credit application, underwriting analysis, appraisals, borrower financial statements, the loan agreement, and any modification or renewal documentation. They compare what is in the file against the bank’s written lending policies to see whether the approval followed the bank’s own rules.
Interviews with loan officers, credit analysts, and senior management are standard. Reviewers want to know not just what the policy says but how it is applied in practice. A well-written policy no one follows is worse than a mediocre policy everyone understands, because it signals a breakdown in the control environment.
Many banks now use automated loan review platforms that integrate with the core banking system, pull borrower data, and flag files for closer attention. These tools speed up sampling and surface patterns across the portfolio, but they have not replaced the judgment of an experienced reviewer reading a credit file.
Risk Rating Validation
This is the heart of the audit. Reviewers independently analyze each sampled loan’s financial data, collateral coverage, and payment history, then assign a risk grade reflecting the likelihood of repayment. The OCC considers accurate risk rating among its top supervisory priorities because the ratings drive nearly everything downstream: reserve levels, capital adequacy calculations, and management’s understanding of where the portfolio stands.3Office of the Comptroller of the Currency. Comptrollers Handbook – Rating Credit Risk
When a reviewer disagrees with the bank’s assigned grade, the disagreement gets documented. In a regulatory exam, it can force the bank to reclassify the loan and increase its reserves. A pattern of overly optimistic internal grading is one of the more serious findings an audit can produce.
Reporting
After the review, the team issues a written report identifying deficiencies, control weaknesses, and compliance gaps, with recommendations or, in a regulatory context, required corrective actions. Management must respond to every finding with a written plan explaining the fix, who owns it, and when it will be done. Unresolved findings carry forward to the next examination and can escalate into formal enforcement if the bank fails to act.
How the Reserve Is Tested
One of the most scrutinized areas in any loan audit is the bank’s reserve against future losses. The old Allowance for Loan and Lease Losses model recognized losses only when a loan showed signs of impairment. It was replaced by the Current Expected Credit Losses (CECL) standard, which took effect for larger SEC filers in 2020 and became mandatory for all remaining institutions for fiscal years beginning after December 15, 2022.
Under CECL, banks must estimate expected losses over the entire remaining life of each loan at origination, incorporating forward-looking economic forecasts rather than waiting for the loan to deteriorate.4Office of the Comptroller of the Currency. Allowances for Credit Losses Comptrollers Handbook The approach front-loads loss recognition and requires banks to maintain models projecting economic conditions over a “reasonable and supportable” forecast period, then reverting to historical averages beyond that window.
Examiners test whether the methodology uses appropriate segmentation, reasonable economic assumptions, and defensible reversion techniques. They review model validation reports, quarterly reserve calculations, and any qualitative adjustments management applied. A bank that cannot explain why it chose a particular forecast horizon or why it adjusted the model output is going to have a difficult conversation with the examiner.
What Gets Flagged Most Often
Documentation Gaps
Missing or incomplete documentation is the single most common finding — unsigned loan agreements, expired borrower financials, missing appraisals, collateral records that were never filed. Federal safety and soundness standards require documentation that enables the bank to make informed credit decisions, assess ongoing risk, and legally enforce its claim against a borrower.5eCFR. 12 CFR Part 30 – Safety and Soundness Standards The fix is tedious but straightforward: someone has to audit the files before the auditors do.
Weak Underwriting
Examiners look for loans approved despite not meeting the bank’s own credit standards, and for cases where the analysis of the borrower’s ability to repay was thin or missing. Federal standards require underwriting that considers overall financial condition, collateral value, and the borrower’s willingness to repay.5eCFR. 12 CFR Part 30 – Safety and Soundness Standards A policy exception is not automatically a problem. Banks make them for good reasons. But the file needs to document why the exception was justified and who approved it.
Inadequate Monitoring
Approving a loan correctly is only the beginning. Common findings include failure to collect updated financial statements, delays in recognizing deteriorating credit quality, and slow downgrades on loans that should have been reclassified months earlier. Monitoring failures directly undermine the accuracy of risk ratings and reserve calculations.
Concentration Risk
A bank that lends heavily into a single industry, geography, or loan type is exposed to concentration risk. Federal guidelines treat exposure exceeding 25 percent of Tier 1 capital plus the allowance for credit losses as a concentration.6Office of the Comptroller of the Currency. Comptrollers Handbook – Concentrations of Credit Commercial real estate draws particular scrutiny. Interagency guidance flags banks where construction and land development loans reach 100 percent of total capital, or where total commercial real estate loans hit 300 percent of total capital with growth exceeding 50 percent over the prior three years.7Board of Governors of the Federal Reserve System. Interagency Guidance on Concentrations in Commercial Real Estate Lending Sound Risk Management Practices These are not hard limits, but crossing them guarantees closer regulatory attention.
Fair Lending Problems
Regulators review lending patterns for signs of discrimination prohibited under the Equal Credit Opportunity Act and the Fair Housing Act. ECOA bars discrimination based on race, color, religion, national origin, sex, marital status, age, or receipt of public assistance income. The Fair Housing Act adds protections for familial status and disability in residential lending.8FFIEC. Interagency Fair Lending Examination Procedures Examiners analyze Home Mortgage Disclosure Act data, compare outcomes for similarly qualified applicants from different demographic groups, and look for pricing disparities with no legitimate business explanation. Fair lending findings can trigger referrals to the Department of Justice.
Disclosure and Timing Errors
Mortgage audits frequently check compliance with the TILA-RESPA Integrated Disclosure rules, which require that borrowers receive a closing disclosure at least three business days before consummation. If certain key terms change after the initial disclosure, including an inaccurate APR, a changed loan product, or an added prepayment penalty, a new three-day waiting period is required.9Consumer Financial Protection Bureau. TILA-RESPA Integrated Disclosure FAQs Banks that routinely close too fast or deliver corrected disclosures late accumulate compliance violations that look bad in the aggregate, even when each individual error seems minor.
What Happens After the Findings
Findings do not all carry the same weight. The most common outcome is a Matter Requiring Attention (MRA), a written communication directing the bank to fix a specific practice. MRAs are not defined in any statute or regulation. The agencies created them through internal guidance, but they are mandatory, not optional. A bank that receives an MRA is generally expected to develop a detailed remediation plan, have it approved by the regulator, implement it, verify through internal audit that the fix is sustainable, and obtain a final determination from the examiner that the work is complete. A Matter Requiring Immediate Attention (MRIA) signals a problem the regulator considers serious enough to demand faster action.
When a bank ignores supervisory findings or when the deficiencies are severe enough on their own, regulators escalate to formal enforcement. The OCC has authority to issue cease and desist orders, civil money penalties, formal agreements with the bank’s board, safety and soundness orders under 12 CFR 30, and orders prohibiting individuals from the banking industry.10Office of the Comptroller of the Currency. Enforcement Action Types The FDIC and Federal Reserve have comparable authority over the institutions they supervise. These actions are public. A consent order posted on a regulator’s website is visible to investors, counterparties, and depositors, and the reputational cost often exceeds the financial one.
What Borrowers May Notice
Loan audits are an internal bank process, but the effects reach borrowers. When an audit reveals a bank has been too aggressive in a particular loan segment, the bank will typically tighten underwriting for that category. A commercial real estate borrower who got favorable terms last year may see stricter terms this year after an examiner flagged concentration risk.
Sometimes auditors or examiners contact borrowers directly to verify collateral, confirm balances, or check the accuracy of financial information the borrower provided. This happens most often with large commercial credits or complex financing arrangements. It is routine and does not mean anything is wrong with the loan.
If your file is selected for review, the bank may ask for updated financial statements, tax returns, or insurance certificates before examiners arrive. Responding promptly matters. An incomplete file creates a documentation finding that can change how the bank classifies your loan, potentially triggering tighter monitoring or an earlier renewal conversation than you expected.
How Banks Stay Ready
Banks that treat audit preparation as a year-round discipline rather than a scramble produce better results. The institutions that consistently get clean examinations share a few habits.
They maintain files continuously. Loan files are reviewed for completeness at origination, at every renewal, and whenever borrower financials come in. Waiting for an audit to be announced before hunting for missing documents is a losing strategy.
They keep credit risk review independent. A separate team, distinct from both lending staff and internal audit, validates risk ratings on an ongoing cycle. This catches grading drift before examiners do.2Federal Reserve System. Interagency Guidance on Credit Risk Review Systems
They close out prior findings with documented evidence. Nothing irritates an examiner more than seeing the same finding repeated from the last exam.
They document the reserve methodology. With CECL now fully in effect, examiners expect detailed records of loss estimation models, the economic assumptions feeding them, any qualitative adjustments, and the rationale behind each.4Office of the Comptroller of the Currency. Allowances for Credit Losses Comptrollers Handbook
They train loan officers on current regulatory expectations for documentation, underwriting, monitoring, fair lending, and disclosure timing. Violations in those last two areas carry outsized consequences.
The banks that struggle most in audits are usually not the ones with bad loans. They are the ones with bad processes: sloppy files, stale financial data, risk grades nobody updates, and reserve models nobody can explain. An examiner can work with a bank that made a few difficult loans and knows it. An examiner has a much harder time with a bank that cannot demonstrate it understands its own portfolio.