Community Banking Risk Management Survey: Six Years After the Crisis


In the aftermath of the devastating financial crisis beginning in 2008, community banks have been inundated with a constant wave of new regulations, regulatory guidance, and hard-hitting examinations, resulting in consent orders becoming the norm.


At the same time, the industry saw hundreds of banks fail, curtailed lending by banks imposing more conservative underwriting standards, and banks forced to consolidate or shrink due to a lack of capital availability in order to survive.

Six years later, how have community banks responded to these new expectations?

Peter Cherpack of Ardmore Banking Advisors and Brian W. Jones of Newfield National Bank surveyed community bankers, from banks between $200 million and $1 billion in assets, with a majority in the $300 million to $500 million range, to see if the message about the importance of proactive risk management was still being pushed by regulators, and how the bankers were responding.  The survey focused on the following three components of a proactive risk management framework specifically highlighted by regulators through published guidelines, handbook updates and advisory articles.

What follows are the findings of that survey.  

Concentration Management

As stated in The Concentrations of Credit Handbook published by the OCC in December 2011, regulators believe that identifying, measuring and appropriately mitigating concentration risk is ultimately dependent on the accurate and timely receipt and analysis of data, and that the effectiveness of concentration management is tied to the effectiveness of a bank’s MIS. 

“The absence of a sufficiently robust set of data elements will hinder an institution’s ability to identify and monitor concentration risk, regardless of the data’s accuracy and timeliness. The OCC expects that each bank’s concentration risk management systems and MIS will be accurate and timely, and that the scope of the data elements collected and analyzed will be proportional to the size and complexity of the bank’s portfolio.”

- The Concentrations of Credit Handbook, OCC, December 2011
Regulatory agencies began to state that they did expect community banks to invest the time and effort required to create processes and MIS practices to report on concentrations of risk, and the OCC outlined examples of the size and type of concentrations to monitor. Their rule of thumb was that any exposure pool or loans with similar risk characteristics of more than 25% of the bank’s capital was considered “a concentration”. They explained that the community bank needed to be able to sort and categorize its portfolio into pools to measure against capital levels.

Historically, prior to 2008, concentration management was only performed on a limited basis in community banks, but the survey results indicated the following:  
  • 85% of respondents reported that they are addressing concentration management in a more aggressive fashion
  • Most respondents said that they use an internal spreadsheet to maintain reports, with a majority presenting reports to management and the board on a quarterly basis
  • All respondents said that they track CRE concentrations in some manner, and most said that they tracked concentrations by NAICS code  
  • Of the three proactive credit management practices reviewed in this survey, respondents felt most comfortable with their capabilities in concentration management
Stress Testing
In two articles published within months of each other in the summer of 2012, the FDIC and OCC both suggested that by implementing some kind of stress testing, community banks could gain useful information and potentially mitigate negative market developments.
“Simple, straightforward stress tests can provide useful insight into concentrated credit portfolios held by community banks.”

“The OCC, however, does consider some form of stress testing or sensitivity analysis of loan portfolios on at least an annual basis to be a key part of sound risk management for community banks. Community banks that have incorporated such concepts and analyses into their credit risk management and strategic and capital planning processes have demonstrated the ability to minimize the impact of negative market developments more effectively than those that did not use stress testing.” 
While clearly endorsing and recommending stress testing concentrations and capital as the recommended proactive best practice, all agencies, including the Fed, clearly stated that there was no one endorsed way to do it, and that they did not expect community banks to apply stress testing at the complexity level expected for banks over $10 billion in assets.
However, in various publications, the OCC and FDIC gave examples of the stress testing that they are expecting community banks to perform, including “simple” two-year capital loss stress testing of the entire balance sheet, concentration “sensitivity” portfolio stress testing based on market scenarios, reverse stress testing, individual transaction and loss migration, among other types.  

The agencies suggest that the simple testing can be done with spreadsheets or vendor supplied packages, and do not need to be scientific or mathematically precise. The key concept is to put a program and process in place that is meaningful, with results that can be understood, communicated to management and the board, and integrated into the credit risk management process.  Based on these criteria, the bankers surveyed provided the following assessment of the current state of stress testing:  
  • The majority of surveyed banks have been addressing stress testing in a more advanced manner in the past six years
  • 71% of reporting banks perform some sort of stress testing on their individual loans, but only about 40% perform stress testing on a portfolio basis (the expected best practice as outlined by agencies)
  • Some level of capital stress testing is currently being performed by 42% of respondents, with an additional 29% reporting that they are planning on implementing it
  • Roughly 50% of banks reported that stress testing results are incorporated into their bank’s strategic plan
  • Most banks acknowledged that there is opportunity to improve their stress testing function and implementation
Capital Planning
In their various publications, the agencies have made it clear that they believe capital adequacy to be key to a bank's health, particularly in community banks where capital can be tight.  As a proactive risk management practice, maintaining adequate capital levels is not purely mathematical; there must be proactive planning and assessment practices that take the unique lending profile and risk factors of the bank into account. 
“The OCC expects every bank, regardless of size or charter type, to have an effective internal process to (1) assess its capital adequacy in relation to its overall risks and (2) plan for maintaining appropriate capital levels…. The OCC will evaluate the adequacy of a bank’s assessment and its compliance with OCC policies and regulatory capital requirements as part of the OCC’s ongoing supervision of the bank.” 
-Guidance for Evaluating Capital Planning & Adequacy, OCC, June 2012
Community banks are not expected to have capital planning processes that are as complex and robust as larger financial institutions. The exact content, extent, and depth of the capital planning process are considered along with the overall risks, complexity, and corporate structure of the bank. Some form of proactive capital planning and monitoring structure communicated to the board is a bare minimum for all banks today, and considered critical for community bank health.  With that in mind, the survey respondents revealed the following about capital planning:  
  • 100% of banks surveyed are addressing capital planning differently since the 2008 financial crisis
  • All banks surveyed have active plans in place regarding the projection of capital needs and active capital projection process and plans for mitigation of apparent capital losses
  • 100% of banks report their capital analysis to the Board, and 50% of respondents said that capital planning affects their lending function and objectives
  • A majority of banks said that their capital planning practices were of good quality. 
The pressure on community bankers to respond to the reduced margins, higher desired capital levels and increased regulations is daunting, and the agencies understand this. It appears that the regulators are attempting to lead community bankers to use “scaled down” non-mandatory proactive credit risk ideas and concepts that will assist them to avoid future risk, but without forcing them to adopt new practices that the community bankers find overbearing.

It remains to be seen how these ideas, concepts and guidance will eventually be adopted by community banks. It would appear that, for now, unless these practices are applied in a mandatory prescriptive manner they will be largely ignored, or only tacitly applied by community banks. Regulators have to deal with the difficult quandary of trying to make community bankers employ better risk management processes without appearing to drown them completely in regulatory compliance.

As the economy improves and community bank survival issues reduce, it will be important to see how these newer more proactive credit risk practices, responding to the recent troubles in the banking industry, become part of how community bank credit risk is routinely managed. The most important question to be answered is, if these practices are adopted by community bankers, will a future similar banking crisis be less severe or even avoided?