DSA origination, RCSA and KRI thresholds
A mid-sized bank with 300 branches and 4,000 staff originates unsecured retail loans through 620 direct selling agents (DSAs). The new CRO reviews a sample of 500 files and finds that 22% lack verifiable income proof, 14% show credit limits overridden by branch managers without documented approval, and the exception register is maintained separately in each region. Early delinquency for DSA-sourced loans is 3.8%, against 2.1% for branch-sourced loans. Internal audit also notes that DSA performance is measured mainly on disbursement volume and that 11 DSAs account for 28% of disbursements. The CRO must decide whether the risk is within appetite, how to rate inherent risk and control effectiveness in the RCSA, which KRIs to introduce, and what to escalate to the risk committee. The bank cannot exit all DSAs immediately because they generate 46% of retail originations.
1. How should the CRO rate inherent risk and control effectiveness, and what evidence supports the rating?
Read the worked answer
Inherent risk should be rated high, not medium, because the product is unsecured, origination depends on 620 third parties, 11 DSAs produce 28% of volume, and branch override evidence suggests a weak control culture. Control effectiveness should be rated weak or partially effective: 22% missing income proof and 14% undocumented overrides are not isolated exceptions in a 500-file sample, and the decentralised exception register prevents aggregation. The 3.8% versus 2.1% early delinquency is a lagging indicator that supports the assessment but does not by itself prove causation.
In RCSA terms, high inherent risk with weak controls gives high residual risk. The CRO should avoid averaging across regions and should record evidence, sample sizes and failed controls. The assessment should also flag fraud, compliance and reputational risk. The conclusion should be that the risk is outside appetite at current volumes until controls improve.
2. Design four or five KRIs with thresholds and explain how they would escalate.
Read the worked answer
KRIs should be leading where possible and tied to thresholds. Examples:
- Files missing verifiable income proof: green below 5%, amber 5–10%, red above 10%.
- Credit-limit overrides without documented approval: green below 2%, amber 2–5%, red above 5%.
- DSA 90+ delinquency gap versus branch-sourced loans: green below 50 bps, amber 50–150 bps, red above 150 bps.
- Top-10 DSA concentration: green below 25%, amber 25–35%, red above 35%.
- Exceptions ageing over 30 days: green below 10% of exceptions, amber 10–20%, red above 20%.
Set red triggers for risk committee escalation and amber for the operational risk committee. Recalibrate quarterly using actual loss and near-miss data. A KRI that only reports DSA disbursement volume is a growth metric, not a risk metric.
3. What should the CRO escalate and in what sequence should remediation proceed?
Read the worked answer
Escalate the high residual risk, the DSA concentration and the incentive conflict to the risk committee and board risk committee. Immediate actions: suspend new onboarding or cap volume for the worst DSAs, re-verify a statistically valid sample, centralise the exception register, require documented override approval, and change DSA incentives to include quality and delinquency.
Do not exit all DSAs immediately because 46% of originations would be disrupted; instead set concentration limits and a remediation timeline. Assign accountable owners in credit, operations and compliance. Report progress monthly. If risk appetite is exceeded and remediation slips, require a formal risk acceptance with limits or reduce volumes. The sequence should protect the bank first, fix root causes second, and redesign the DSA model third.