A Loan Officer's Side Business
An internal auditor at a $2.4 billion community bank is reviewing the consumer lending department. A loan officer, who has authority to approve unsecured loans up to $75,000, has approved 14 loans over eight months to borrowers who all list the same employer, a small construction company owned by the loan officer's brother-in-law. The loans total $610,000, all are current, and none exceed the officer's limit. The loan officer disclosed the relationship on an annual conflict-of-interest form, but the form was filed after the loans were made and the disclosure does not mention specific borrowers. The bank's policy requires that loans to insiders and related parties be approved by a senior officer and reported to the board. The loan officer says the borrowers are simply employees of a good local business.
1. Does this constitute a policy violation, and what audit procedures should follow?
Read the worked answer
Yes, at minimum a policy violation and possibly a regulatory issue. The policy requires senior-officer approval and board reporting for related-party loans. The borrowers are not themselves insiders, but the pattern - a single employer owned by a relative of the approving officer - creates a related-party nexus that a reasonable reviewer would treat as requiring heightened approval. The late, generic disclosure does not satisfy the policy's intent because it was not specific enough to allow the bank to identify the exposure.
Procedures: (1) obtain the ownership records of the construction company to confirm the brother-in-law's interest; (2) pull all loans approved by the officer in the period, not just the 14, and test for other common addresses, employers, or phone numbers; (3) review the loan files for underwriting quality - income verification, debt-to-income, and whether the loans were priced consistently with policy; (4) interview the senior lending officer about whether any approval was sought informally; (5) check whether the loans appear on the board's related-party report; and (6) review the conflict-of-interest process for timeliness and specificity. The auditor should preserve the disclosure forms and any emails.
2. The loans are all performing. How does that affect the auditor's conclusion and reporting?
Read the worked answer
Performance does not cure a governance failure. The auditor's conclusion should address process and conflict management, not credit loss. A related-party lending program that bypasses approval can still be sound credit, but it exposes the bank to self-dealing risk, reputational harm, and potential violations of Regulation O if any borrower is an insider or executive officer. The auditor should state that no loss has occurred but that the control environment failed.
Reporting: the finding should go to the chief audit executive and, given the insider dimension, to the audit committee or board. The recommendation should require prospective senior-officer approval for any loan to a borrower whose employer is owned by a relative of the approving officer, a specific and timely conflict disclosure that names the relationship and the affected borrowers, and a look-back review of the officer's portfolio. The auditor should also consider whether the officer's approval authority should be suspended pending review, and should document the rationale either way. The tone should be factual: the pattern, the policy, the gap, and the fix.