Northgate Mutual: overrides, outsourcing and a regulator watching

Design deficiencies

• Override capability without constraints. An override that does not require a reason, a higher approval level or logging is not a controlled exception; it is an uncontrolled bypass. The design permits the affordability policy to be disapplied silently.
• Sampling too weak to detect. A 2% post-completion sample cannot provide assurance when 14% of applications are overridden. Even if overrides were the only defect, the sample would rarely surface them, so a 'no exceptions' result is a statement about the sample, not about the book.
• No independent model validation. The affordability model is the primary control and there is no evidence it has been validated, back-tested or challenged.
• Outsourcing without effective oversight. A qualified assurance opinion, with no right-to-audit or onsite review evidenced, means the society cannot demonstrate that the reconciliation control operates.
• No reporting line. Overrides reach no committee, so the board and risk function are structurally blind to the highest-risk lending decisions.

Operating effectiveness issues

• Three consecutive quarters of nil exceptions is implausible against a 14% override rate. That is evidence of a control failing to detect, not evidence of good conduct.
• The qualified assurance report is direct evidence that a key outsourced control is not operating as intended.

Greatest prudential risk The combination of unlogged overrides, 95% LTV concentration, broker-originated volume and rising arrears. High LTV means high loss given default; unlogged overrides mean the expected loss is mispriced and invisible. Broker concentration adds conduct and quality risk, because the society does not control the advice or the packaging. The outsourced reconciliation is a control failing, but it is second-order compared with underwriting that cannot be evidenced.

Key distinction The board should stop asking whether controls exist and start asking whether they would detect the thing that matters at the rate it occurs.

Terminate: reject the option as framed Stopping broker lending outright is disproportionate. At 40% of flow it would remove a large share of new business and earnings, and brokers are not intrinsically the problem: ungoverned overrides are. Terminate individual brokers on performance scorecards instead.

Treat: the core of the response

• Override governance: require a written reason, a second sign-off above a defined DTI or LTV threshold, monthly reporting of override rate by underwriter, broker and LTV band, and a limit that triggers escalation. Cost is low; effect on residual risk is high because it converts an invisible exposure into a measured one.
• Independent model validation and back-testing of the affordability model against actual arrears by vintage. Cost is modest and it tests the control that matters most.
• Increase post-completion sampling to a level with statistical power, targeted by risk band rather than random. For example, sample 10% of overrides and all loans above 90% LTV with a DTI above threshold. Cost rises but detection improves.
• Onsite oversight of the outsourced reconciliation, including a contractual right to audit and a remediation requirement against the qualified opinion.

Transfer: selective, not a substitute Mortgage indemnity insurance on lending above 90% LTV transfers severe loss given default. It is priced and may reduce capital requirements, but it does not fix underwriting and it can create moral hazard. Model the cost against expected loss reduction before buying; it is most defensible for the highest-LTV, highest-DTI segment.

Tolerate: explicitly and with monitoring Retain the existing back book within a stated tolerance, with monthly arrears-by-vintage reporting and forbearance capacity. Reducing maximum LTV to 85% for all new lending would cut volume and margin; applying it only to overrides and high-DTI cases is the better trade-off.

Residual risk and evidence After these measures the residual risk is concentrated in the existing 95% LTV book and in broker conduct. The board should state that residual position in the remediation plan, name the owner, and set a tolerance for arrears and override rate that triggers further action. The PRA will judge the plan on whether it is evidence-based and measured, not on how tough the headline response sounds.

Evidence standard The board should require evidence that controls would detect a defined failure at the rate it occurs, not assurances that no failures were found. That means designing tests with stated sample sizes and confidence, and reporting the population tested.

Control testing

• Override testing: 100% automated capture of override reasons and approver identity, with periodic audit of a statistically valid sample. Report the override rate, the proportion with documented rationale, and the arrears rate split by override status.
• Model validation: independent back-testing of predicted versus actual default by vintage and LTV band, with results and model limitations reported to the risk committee.
• Post-completion checks: risk-targeted sampling with a stated confidence level, plus mystery shopping of the broker channel and file reviews by internal audit.
• Outsourced reconciliation: onsite review, evidence of right-to-audit exercised, and closure of the qualified opinion with independent verification.
• Three lines assurance: second-line compliance testing and third-line internal audit opinion, reported directly to the audit committee.

Reporting Monthly management information to the risk committee, quarterly to the board, covering the full population, not just exceptions. The remediation plan should have named owners, dates and a status of red, amber or green, with independent verification at completion. Regulator reporting should show the same numbers the board sees.

Key risk indicators and thresholds

• Override rate by underwriter, broker and LTV band; target below an agreed level, with any concentration triggering review.
• Percentage of overrides with a documented rationale; target 100%.
• Arrears by vintage, LTV and channel; a rising trend in the 95% LTV cohort is an early warning.
• Broker concentration and broker quality scorecard positions.
• Exceptions per 1,000 files reviewed, and average time to remediate.
• Model performance drift: actual versus predicted defaults.

Judgement The strongest evidence is a trend, not a snapshot: override rates falling, rationale coverage at 100%, arrears stabilising in new vintages, and audit findings closing on time. The board should also require a statement of residual risk it is being asked to accept, because a remediation plan that claims zero residual risk is not credible.