Principle 14: Banks must establish a system of independent, ongoing assessment of the bank’s credit risk management processes and the results of such reviews should be communicated directly to the board of directors and senior management.

73. Because various appointed individuals throughout a bank have the authority to grant credit, the bank should have an efficient internal review and reporting system in order to manage effectively the bank’s various portfolios. This system should provide the board of directors and senior management with sufficient information to evaluate the performance of account officers and the condition of the credit portfolio.

74. Internal credit reviews conducted by individuals independent from the business function provide an important assessment of individual credits and the overall quality of the credit portfolio. Such a credit review function can help evaluate the overall credit administration process, determine the accuracy of internal risk ratings and judge whether the account officer is properly monitoring individual credits. The credit review function should report directly to the board of directors, a committee with audit responsibilities, or senior management without lending authority (e.g., senior management within the risk control function).

Principle 15: Banks must ensure that the credit-granting function is being properly managed and that credit exposures are within levels consistent with prudential standards and internal limits. Banks should establish and enforce internal controls and other practices to ensure that exceptions to policies, procedures and limits are reported in a timely manner to the appropriate level of management for action.