For this newsletter CFO Consulting Partners has partnered with Ardmore Banking Advisors to review the potential material financial benefits of a well planned and executed implementation of the new current expected credit loss (“CECL”) accounting standard.

Most banks have an awareness of the need to prepare for the transition to CECL, and that many foundational activities need to be looked at now. Together CFO Consulting Partners (“CFO CP”) and Ardmore Banking Advisors (“Ardmore”) have constructed an approach to help banks address the “early must do’s” of CECL at a reasonable cost.

CFO CP leverages its extensive experience with banking industry finance, and Ardmore it’s deep expertise in credit and credit data to translate the CECL transition process into tasks and activities that create valuable efficiencies and bottom line impact for the Bank. Together we can cut through the noise and assess a bank’s CECL readiness and at the same time help create a CECL action plan that will drive real value for the bank.

We have discussed aspects of CECL implementations in prior newsletters, The New CECL Approach Part I, and Part II. Similarly, Ardmore’s webinar Step #1 Of the CECL Journey provides additional perspective.

CFO CP and Ardmore are each focused on complementary aspects of the CECL implementation process in the finance, accounting, and credit disciplines. Well executed CECL projects led by an interdisciplinary team of Credit, Finance, and other bank management, coordinated by experienced project managers and executed well, can produce tangible bottom line improvements, and better efficiency ratios.

Experienced CFO CP and Ardmore Project Managers can help the bank’s CECL team identify opportunities for process improvements. The resulting databases, internal control enhancements, and automation will produce faster decisions, easy access to controlled and trusted data, high functioning executive teams and, ultimately, improved efficiency ratios. If CECL implementation is managed well, a bank can leverage the implementation to break down silos, upgrade systems, improve processes, and reduce expenses.

CFOs can strategically manage the spending to required accomplish CECL goals AND drive efficiencies which will ultimately reduce the expense ratio. Opportunities exist in:

• Credit Administration: Ensure that all credit practices are properly aligned with your CECL implementation, upgrade automation, and improve underwriting processes.
• Finance: Re-engineer financial controls and loan accounting processes, optimize general ledgers, optimize risk adjusted capital levels, and Improve management information for the Board and Management.
• IT: Improve data governance, develop and data management tools, and retire inefficient loan and credit systems.
• Operations: Update credit processes (such as data entry and coding processes), and re-engineer controls and processes
• Lending: Efficient analysis of deal structures and lending to minimize life of loan losses and capital impacts

An assessment for CECL readiness can reveal a lot that can be useful to the institution beyond the needs of CECL compliance including:

• Assess the current state of the institution’s credit portfolio data and origination process, ALLL, Financial and Credit policies, practices and governance – all within the context of CECL;
• Review Current ALLL System & Processes;
• Review controls on data used in the current ALLL process;
• Identify data points required to support industry best practice portfolio data & regulatory compliance data for CECL;
• Review loan origination process, stakeholders, criteria and coding;
• Review data stored in the core for accuracy consistency and robustness;
• Review all identified credit data source systems for data/database integrity; and
• Review any existing data warehouse capabilities, and how portfolio data is organized, maintained, and retained.

CECL compliance practices and implementation plans should be in place in 2018. Auditors, regulators, boards of directors and investors will want to know bank’s plans for CECL, including the costs and the benefits beyond compliance.

Those institutions that leverage the potential benefits of the CECL implementation will have a competitive advantage over their competitors through increased efficiencies, automation and clarification of corporate risk management practices.

About the Authors

CFO Consulting Partners, Tom Van Lenten: Tom leads CFO Consulting Partners CECL consulting services to financial institutions. CFO CP’s CECL services include: CECL readiness assessment, analysis of the accounting and regulatory implications, project management, and assisting with updates of policies, procedures and internal controls which are impacted by CECL.

Ardmore Banking Advisors, Peter Cherpack: EVP, Partner. Peter is a nationally known thought leader in CECL implementation for community banks, and with other Ardmore consultants conducts CECL readiness assessments with a focus on credit and credit data readiness.

Tom Van Lenten, CPA, CFO Consulting Partners LLC

This is the second in the CFO Consulting Partners series of articles analyzing the new FASB Standard on accounting for credit losses (ASU 2016-13). Click here for the first article in the series.

It has been more than a year since the FASB issued ASU 2016-13 Click here for article . The new Standard is most commonly referred to as CECL, which is an acronym for “Current Expected Credit Losses”. The CECL standard requires an entity to recognize a forward-looking estimate of the expected credit losses in the Allowance for Loan and Lease Losses (ALLL), when an asset is booked. Current GAAP requires that the estimate of credit loss is based on incurred losses and banks typically historical losses as the basis for the calculation

CECL is one of the largest and most complex accounting standard implementations ever undertaken in the banking industry. Despite this, many banks have not begun urgent and focused execution of CECL implementation plans. Privately-held companies can see the long transition timeline (implementation is required at January 1. 2021 for non-SEC filers) as a reason for delay. However, public entities must react faster. They are required to include disclosures in their first SEC filings after issuance of ASC 2016-13 on June 16, 2016. The FASB has recently highlighted this disclosure requirement by issuing ACU 2017-3 in January 2017 which gives additional guidance for certain disclosures of standards that are issued but not yet implemented for SEC filers.

• The basic requirements of ASU 2017-3 are:
  if an SEC filer does not know or cannot estimate the financial impact from adoption of a new ASU it should make a statement to that effect and should consider additional qualitative disclosures to assist the reader in assessing the impact that the standard will have
• the ASU also requires additional qualitative disclosures to include a description of the effect of the accounting policies that the SEC filers expect to apply together with a comparison to their current accounting policies,
• additionally, SEC filers should describe the status of the process to implement CECL and the significant implementation matters yet to be addressed.

In a recent informal survey of financial institutions by MST Click here for article covering the implementation of CECL, 5% of the respondents said that they have not yet begun preparation for CECL implementation, and 87% have only held internal discussions about CECL implementation. One experienced CFO has been quoted as saying, “the commonly followed CECL implementation strategy of waiting for other banks to report first is in fact dangerous.”

Considering the size and complexity of CECL implementation we agree that delay is a high-risk approach and that thoughtful planning now will yield significant benefits.

• The major elements of CECL implementation include:
• Analysis of CECL impacts on the bank,
• Project management,
• Credit modeling,
• Accounting Policies,
• Operations,
• Systems integration [click here for a case study of a CFO CP systems integration].

In our next newsletter, we will discuss further considerations in CECL implementations.

Tom Van Lenten, CPA, CFO Consulting Partners LLC

In mid-2016 the FASB issued its long-awaited standard on accounting for credit losses (ASU 2016-13). The new standard adds to US GAAP an impairment model known as the current expected credit loss model or CECL. In a shift from current practice the CECL model is based on expected losses rather than incurred losses. Under the new CECL model an entity recognizes its forward looking estimate of the expected credit losses in the Allowance for Loan and Lease Losses, or ALL when an asset is booked.

The FASB believes that the new standard will result in more timely recognition of credit losses. There is a long transition timeline and implementation is required at January 1, 2020 for calendar-year reporters that are SEC filers, and January 1. 2021 for other entities.

The CECL approach is to be applied to most debt instruments that are not measured at fair value. This includes loan commitments, financial guarantees, lease receivables, trade receivables and held-to-maturity securities. Available for sale debt securities are specifically excluded and will continue to be evaluated for impairment under the AFS securities impairment model.

The Standard does not require use of any one method to compute expected credit losses. Management is expected to maintain complete data sets, documentation, and analysis to support how the selected method fits with the standard and produces realistic estimates of future losses. Examples of some of the acceptable methodologies are:

• Loss rate: Historical loss rates can still be used as a starting point for determining expected credit losses. When using historical loss rates, the Bank would have to consider how conditions that existed during the historical charge-off period differ from current projections and adjust the future loss rates accordingly.
• Discounted cash flow: Projections of principal and interest flows over the life of the asset.
• Probability of default method estimates the probability loans in certain risk-stratified segments will default. This approach computes the percentage of loans that have defaulted in a pool over a look-back period.
• Roll-rate method. The roll-rate method is often referred to as “migration analysis”. It is based on determining a prediction of credit losses based on segmentation (by delinquency or risk rating, for example) of a portfolio of financial assets. No standard roll-rate model is used throughout the financial institutions industry, but most of the models used are based on similar underlying principles.
• Aging analysis: Banks use aging analysis in determining the effectiveness of their credit and collections functions and for estimating potential loan losses. The information from this analysis is used by Banks as a component of their estimate the allowance for loan & lease losses.
• Collateral-value: For loans that are collateral dependent, evaluation of collateral and costs of disposal can be used to estimate expected credit losses.

Institutions with multiple loan types will likely need several methodologies to properly analyze the loss content of each portfolio segment and then aggregate the results to understand the expected losses for entire loan portfolio.

Expected credit impairment will be recognized as an allowance, instead of as a direct write-down of the amortized cost of the financial asset. Changes to the ALLL are recorded immediately through credit loss expense. The carrying amount of a financial asset that is considered to be uncollectible will be written-off in a manner similar to current US GAAP.

While there is significant time until required implementation, it is imperative that management begin the implementation process as soon as possible. The most problematic aspects of CECL implementation will likely be: a) developing the support systems and processes, b) gathering and organizing the historical data to support new methodologies, and c) developing going forward data capture and analysis processes.

• With respect to a) above, existing modeling approaches currently used for Basel, and stress testing may be leveraged and adapted for CECL. However, new credit loss models will likely need to be implemented. It is anticipated that the development or purchase of credit models that estimate future credit losses may be the most time consuming phase of CECL implementation.
• For b) the historical data requirements for the new models will often not be resident in current financial and credit systems. This data will have to be developed from the bank’s core operating system and organized into databases which the models can access.
• For data capture and analysis c) the starting point for developing a future loss credit loss data base is current loan and credit loss data. Companies implementing CECL should undertake a robust review and analysis of its current loan and credit data so that the process of developing a future credit loss data base starts with historic data that has a high level of accuracy and integrity.

Many of the disclosures required under the new standard are similar to those required under current GAAP. For example disclosures on credit quality, ALLL roll-forward, policies tor determining credit losses, past due and non-accrual status, and collateral dependent assets are the same. There are, however, significant additional disclosures of credit quality indicators, disaggregated by year of origination for a five-year period.

CFO Consulting Partners LLC Cyber Security White Paper March 2015 1 Cyber Security: A fundamental component of Enterprise Risk Management (ERM)

Cyberattacks have hit virtually every industry and the two industries most impacted by incursions, breaches and theft of data are financial services and health care. Financial services and the medical world are inexorably connected to the internet, and they are therefore connected to hackers, cyber criminals and even nation states intent upon getting access to financial and medical records.

Banks are a particular focus of cyber criminals. In a recent speech OCC Head Thomas Curry said,” The financial-services industry is one of the more attractive targets of cyberattacks, and unfortunately the threat is growing.” Further, one growing area of concern is the potential for criminals to target smaller banks. In late 2014 New York State banking regulator Benjamin Lawsky asked the institutions he supervises to understand the increasing complexity and interconnectedness of the financial system, as well as the importance of strong controls and of carefully monitoring the ways in which they connect to third parties.

Banks routinely use advanced statistical models and behavior analytics programs that can spot possible fraud and, to some extent, have a cultural data governance advantage over other industries. Analysts at the Gartner research group estimate that the health care industry is generally about ten years behind the financial services sector in terms of protecting consumer information.

In the healthcare world, major cyber breaches go back to 2010 when the WellPoint medical records breach set two records: the number of members’ records exposed in a security breach, and the size of the settlement amount paid to the Federal Government. The WellPoint breach is estimated to have cost $143 million dollars. These costs were for legal recovery actions, new security control investments, and extended credit and protection services for victims. During an investigation of WellPoint’s information systems, The US Department of Health and Human Services (HHS) found that the Indianapolis-based insurer had not enacted the appropriate administrative, technical and physical safeguards for data which are required Health Insurance Portability and Accountability Act of 1996 (HIPPA).

More recently the dangers of health care cyberattacks were highlighted early in 2015 when Anthem, the nation’s second-largest health insurer, said hackers broke into a database storing information on eighty million people. The hack led to a particularly valuable trove of data because it exposed Social Security numbers.

Basic components of cyber controls framework, and ERM (Risk Management):

• Governance: Cyber Security Companies in all industries need to establish a cybersecurity governance framework which is a central component of the ERM infrastructure. Regular reporting to the Board of Directors will help assure active participation among the Board, Senior Management and IT Management. The visibility of the cybersecurity infrastructure and processes are an important driver of adequate resourcing, which is essential for companies to stay ahead of the many bad actors in the cyberattack world. CFO Consulting Partners LLC Cyber Security White Paper March 2015 2

• Cyber Risk Assessment: Through risk assessments, companies understand the specific risks to their organizational infrastructure and operations. Risk assessment processes identify and document vulnerabilities, highlight internal and external threats, and ultimately prioritize the risk and related responses. The related controls should be organized and implemented as preventive, detective and corrective.

• Technical Controls: The selection of specific controls by any company is dependent the company’s individual risk profile. Many companies use a “defense-in-depth” strategy in which they layer multiple independent security controls strategically throughout their technology systems. One way of looking at this approach is to view the components of a company’s technical infrastructure as residing in partially redundant layers.

• Vendor management: At every touch point vendors can introduce cyber threats (e.g. – viruses) into a company’s systems and data bases. While third party penetration testing is almost impossible with vendors, the company’s threat assessment must thoroughly evaluate each third party touch point for cyber risks.

• Incident Response Planning: An incident response plan is a framework to manage a cybersecurity event and limit the damage. A company’s incident response plan should establish a dedicated Cyber Security Incident Response Team, address all the possible attack vectors and take the legitimate concerns of third parties into account.

• Staff Training: Without adequate staff training and related awareness, the rest of a company’s cybersecurity program can be easily compromised. Companies must define cybersecurity training needs and requirements. Staff need to understand the possible vectors and techniques that the bad actors use to penetrate systems and data bases.

• Cyber Insurance: While almost unknown five years ago, many companies have chosen to obtain cyber risk insurance. Coverage is offered my most major insurance underwriters; premiums vary widely. Underwriting relies heavily on the quality of a company’s cyber control infrastructure. In other words, insurance premiums depend greatly on the quality and strength of the company’s cyber control infrastructure. Note: Cyber Control Framework items above extracted from FINRA 2014 “Report on Cybersecurity Practices”.

Download PDF