Tom Van Lenten, CPA, CFO Consulting Partners LLC

This is the second in the CFO Consulting Partners series of articles analyzing the new FASB Standard on accounting for credit losses (ASU 2016-13). Click here for the first article in the series.

It has been more than a year since the FASB issued ASU 2016-13 Click here for article . The new Standard is most commonly referred to as CECL, which is an acronym for “Current Expected Credit Losses”. The CECL standard requires an entity to recognize a forward-looking estimate of the expected credit losses in the Allowance for Loan and Lease Losses (ALLL), when an asset is booked. Current GAAP requires that the estimate of credit loss is based on incurred losses and banks typically historical losses as the basis for the calculation

CECL is one of the largest and most complex accounting standard implementations ever undertaken in the banking industry. Despite this, many banks have not begun urgent and focused execution of CECL implementation plans. Privately-held companies can see the long transition timeline (implementation is required at January 1. 2021 for non-SEC filers) as a reason for delay. However, public entities must react faster. They are required to include disclosures in their first SEC filings after issuance of ASC 2016-13 on June 16, 2016. The FASB has recently highlighted this disclosure requirement by issuing ACU 2017-3 in January 2017 which gives additional guidance for certain disclosures of standards that are issued but not yet implemented for SEC filers.

• The basic requirements of ASU 2017-3 are:
  if an SEC filer does not know or cannot estimate the financial impact from adoption of a new ASU it should make a statement to that effect and should consider additional qualitative disclosures to assist the reader in assessing the impact that the standard will have
• the ASU also requires additional qualitative disclosures to include a description of the effect of the accounting policies that the SEC filers expect to apply together with a comparison to their current accounting policies,
• additionally, SEC filers should describe the status of the process to implement CECL and the significant implementation matters yet to be addressed.

In a recent informal survey of financial institutions by MST Click here for article covering the implementation of CECL, 5% of the respondents said that they have not yet begun preparation for CECL implementation, and 87% have only held internal discussions about CECL implementation. One experienced CFO has been quoted as saying, “the commonly followed CECL implementation strategy of waiting for other banks to report first is in fact dangerous.”

Considering the size and complexity of CECL implementation we agree that delay is a high-risk approach and that thoughtful planning now will yield significant benefits.

• The major elements of CECL implementation include:
• Analysis of CECL impacts on the bank,
• Project management,
• Credit modeling,
• Accounting Policies,
• Operations,
• Systems integration [click here for a case study of a CFO CP systems integration].

In our next newsletter, we will discuss further considerations in CECL implementations.

Tom Van Lenten, CPA, CFO Consulting Partners LLC

In mid-2016 the FASB issued its long-awaited standard on accounting for credit losses (ASU 2016-13). The new standard adds to US GAAP an impairment model known as the current expected credit loss model or CECL. In a shift from current practice the CECL model is based on expected losses rather than incurred losses. Under the new CECL model an entity recognizes its forward looking estimate of the expected credit losses in the Allowance for Loan and Lease Losses, or ALL when an asset is booked.

The FASB believes that the new standard will result in more timely recognition of credit losses. There is a long transition timeline and implementation is required at January 1, 2020 for calendar-year reporters that are SEC filers, and January 1. 2021 for other entities.

The CECL approach is to be applied to most debt instruments that are not measured at fair value. This includes loan commitments, financial guarantees, lease receivables, trade receivables and held-to-maturity securities. Available for sale debt securities are specifically excluded and will continue to be evaluated for impairment under the AFS securities impairment model.

The Standard does not require use of any one method to compute expected credit losses. Management is expected to maintain complete data sets, documentation, and analysis to support how the selected method fits with the standard and produces realistic estimates of future losses. Examples of some of the acceptable methodologies are:

• Loss rate: Historical loss rates can still be used as a starting point for determining expected credit losses. When using historical loss rates, the Bank would have to consider how conditions that existed during the historical charge-off period differ from current projections and adjust the future loss rates accordingly.
• Discounted cash flow: Projections of principal and interest flows over the life of the asset.
• Probability of default method estimates the probability loans in certain risk-stratified segments will default. This approach computes the percentage of loans that have defaulted in a pool over a look-back period.
• Roll-rate method. The roll-rate method is often referred to as “migration analysis”. It is based on determining a prediction of credit losses based on segmentation (by delinquency or risk rating, for example) of a portfolio of financial assets. No standard roll-rate model is used throughout the financial institutions industry, but most of the models used are based on similar underlying principles.
• Aging analysis: Banks use aging analysis in determining the effectiveness of their credit and collections functions and for estimating potential loan losses. The information from this analysis is used by Banks as a component of their estimate the allowance for loan & lease losses.
• Collateral-value: For loans that are collateral dependent, evaluation of collateral and costs of disposal can be used to estimate expected credit losses.

Institutions with multiple loan types will likely need several methodologies to properly analyze the loss content of each portfolio segment and then aggregate the results to understand the expected losses for entire loan portfolio.

Expected credit impairment will be recognized as an allowance, instead of as a direct write-down of the amortized cost of the financial asset. Changes to the ALLL are recorded immediately through credit loss expense. The carrying amount of a financial asset that is considered to be uncollectible will be written-off in a manner similar to current US GAAP.

While there is significant time until required implementation, it is imperative that management begin the implementation process as soon as possible. The most problematic aspects of CECL implementation will likely be: a) developing the support systems and processes, b) gathering and organizing the historical data to support new methodologies, and c) developing going forward data capture and analysis processes.

• With respect to a) above, existing modeling approaches currently used for Basel, and stress testing may be leveraged and adapted for CECL. However, new credit loss models will likely need to be implemented. It is anticipated that the development or purchase of credit models that estimate future credit losses may be the most time consuming phase of CECL implementation.
• For b) the historical data requirements for the new models will often not be resident in current financial and credit systems. This data will have to be developed from the bank’s core operating system and organized into databases which the models can access.
• For data capture and analysis c) the starting point for developing a future loss credit loss data base is current loan and credit loss data. Companies implementing CECL should undertake a robust review and analysis of its current loan and credit data so that the process of developing a future credit loss data base starts with historic data that has a high level of accuracy and integrity.

Many of the disclosures required under the new standard are similar to those required under current GAAP. For example disclosures on credit quality, ALLL roll-forward, policies tor determining credit losses, past due and non-accrual status, and collateral dependent assets are the same. There are, however, significant additional disclosures of credit quality indicators, disaggregated by year of origination for a five-year period.

CFO Consulting Partners LLC Cyber Security White Paper March 2015 1 Cyber Security: A fundamental component of Enterprise Risk Management (ERM)

Cyberattacks have hit virtually every industry and the two industries most impacted by incursions, breaches and theft of data are financial services and health care. Financial services and the medical world are inexorably connected to the internet, and they are therefore connected to hackers, cyber criminals and even nation states intent upon getting access to financial and medical records.

Banks are a particular focus of cyber criminals. In a recent speech OCC Head Thomas Curry said,” The financial-services industry is one of the more attractive targets of cyberattacks, and unfortunately the threat is growing.” Further, one growing area of concern is the potential for criminals to target smaller banks. In late 2014 New York State banking regulator Benjamin Lawsky asked the institutions he supervises to understand the increasing complexity and interconnectedness of the financial system, as well as the importance of strong controls and of carefully monitoring the ways in which they connect to third parties.

Banks routinely use advanced statistical models and behavior analytics programs that can spot possible fraud and, to some extent, have a cultural data governance advantage over other industries. Analysts at the Gartner research group estimate that the health care industry is generally about ten years behind the financial services sector in terms of protecting consumer information.

In the healthcare world, major cyber breaches go back to 2010 when the WellPoint medical records breach set two records: the number of members’ records exposed in a security breach, and the size of the settlement amount paid to the Federal Government. The WellPoint breach is estimated to have cost $143 million dollars. These costs were for legal recovery actions, new security control investments, and extended credit and protection services for victims. During an investigation of WellPoint’s information systems, The US Department of Health and Human Services (HHS) found that the Indianapolis-based insurer had not enacted the appropriate administrative, technical and physical safeguards for data which are required Health Insurance Portability and Accountability Act of 1996 (HIPPA).

More recently the dangers of health care cyberattacks were highlighted early in 2015 when Anthem, the nation’s second-largest health insurer, said hackers broke into a database storing information on eighty million people. The hack led to a particularly valuable trove of data because it exposed Social Security numbers.

Basic components of cyber controls framework, and ERM (Risk Management):

• Governance: Cyber Security Companies in all industries need to establish a cybersecurity governance framework which is a central component of the ERM infrastructure. Regular reporting to the Board of Directors will help assure active participation among the Board, Senior Management and IT Management. The visibility of the cybersecurity infrastructure and processes are an important driver of adequate resourcing, which is essential for companies to stay ahead of the many bad actors in the cyberattack world. CFO Consulting Partners LLC Cyber Security White Paper March 2015 2

• Cyber Risk Assessment: Through risk assessments, companies understand the specific risks to their organizational infrastructure and operations. Risk assessment processes identify and document vulnerabilities, highlight internal and external threats, and ultimately prioritize the risk and related responses. The related controls should be organized and implemented as preventive, detective and corrective.

• Technical Controls: The selection of specific controls by any company is dependent the company’s individual risk profile. Many companies use a “defense-in-depth” strategy in which they layer multiple independent security controls strategically throughout their technology systems. One way of looking at this approach is to view the components of a company’s technical infrastructure as residing in partially redundant layers.

• Vendor management: At every touch point vendors can introduce cyber threats (e.g. – viruses) into a company’s systems and data bases. While third party penetration testing is almost impossible with vendors, the company’s threat assessment must thoroughly evaluate each third party touch point for cyber risks.

• Incident Response Planning: An incident response plan is a framework to manage a cybersecurity event and limit the damage. A company’s incident response plan should establish a dedicated Cyber Security Incident Response Team, address all the possible attack vectors and take the legitimate concerns of third parties into account.

• Staff Training: Without adequate staff training and related awareness, the rest of a company’s cybersecurity program can be easily compromised. Companies must define cybersecurity training needs and requirements. Staff need to understand the possible vectors and techniques that the bad actors use to penetrate systems and data bases.

• Cyber Insurance: While almost unknown five years ago, many companies have chosen to obtain cyber risk insurance. Coverage is offered my most major insurance underwriters; premiums vary widely. Underwriting relies heavily on the quality of a company’s cyber control infrastructure. In other words, insurance premiums depend greatly on the quality and strength of the company’s cyber control infrastructure. Note: Cyber Control Framework items above extracted from FINRA 2014 “Report on Cybersecurity Practices”.

Download PDF