You are here

Strategic Planning for CRE Concentration Risk

Written by: 
Alan D. Lloyd, CPA

Financial institutions have lived in an ultra-low interest rate environment for so long it seems to be the new normal. From an interest rate risk perspective, shorter term, higher rate commercial loans are more attractive than longer-term residential loans in this low rate environment. Given the uncertainty in the market, it is imperative for bank boards to closely monitor larger concentrations in their commercial portfolios.

As interest rates rise, capitalization rates rise, causing commercial real estate values to decrease. Using guidance issued by the Office of the Comptroller of the Currency, you can strategically plan for adding commercial real estate loans to your portfolios or apply sound risk management practices to your existing loans.

The OCC Bulletin 2006-46, Interagency Guidance on CRE Concentration Risk Management, is the most comprehensive guidance issued thus far. While 10 years old, it is a meaningful resource for those looking to enter or expand into CRE lending. This guidance introduced the “warning” with regard to CRE exceeding 300% of capital. Per the OCC, it “does not establish specific limits on CRE lending; rather, it describes sound risk management practices that will enable institutions to pursue CRE lending in a safe and sound manner.”

The guidance consists of seven areas that will be important to monitor if you determine you have a CRE concentration risk or are considering becoming more involved in commercial real estate:

  1. Board and management oversight
  2. Portfolio management
  3. Market analysis
  4. Management information systems
  5. Portfolio stress testing and sensitivity analysis
  6. Credit underwriting standards
  7. Credit risk review function

Across all of these categories, there is one vital component that must be addressed throughout the portfolio overall, and again with a more narrow focus on the specific requirements of each category: the integrity of the data. Data integrity is critical for the overall monitoring of a CRE portfolio. Inaccurate data can make your reporting and monitoring efforts meaningless and can leave you at risk of regulatory action.

That said, let’s take a look at each of the categories in turn.

Board and Management Oversight

An engaged board of directors is vital to the success of an institution regardless of the topic on the table; so too is ensuring that the board has access to the correct level of detailed information to ensure their engagement is effective.

If your bank is considering entering the CRE space or expanding its offerings, it is vital that the board receive good reports and dashboards. A “good” report includes the right level of detail and accurate information.  It’s not effective to say, for example, “We’re at 300 percent of capital, time to cut back on our CRE lending.”  Detailed reporting can allow the institution to fully understand the risks in its portfolio and how they align with the bank’s overall strategic plan.

Reporting must be granular enough to enable the user to understand the risks. Information should be categorized by concentration in specific industry categories such as office, retail, hotels, restaurants, etc. It should include reporting by division or at the loan officer level to identify potential areas of concern or sources of problem loans. To best manage that risk, metrics such as underwriting exceptions, average debt-service-coverage, average LTV, risk ratings, etc., should be monitored for specific subcategories of the CRE portfolio.

Once that information is provided to the board, directors should be able to ask relevant questions and hold management accountable for their decisions.

Finally, boards and leadership should ensure that the institution’s strategic plan incorporates the interdependency of earnings risk, capital risk, credit risk and concentration risk. Three-year projections should align with the institution’s goals and policies and procedures should be developed that allow management to execute the plan.

Portfolio Management

Once again the integrity of the data is vital to the success of managing the portfolio. Assuming sound data, banks need to assess the balance of the portfolio’s composition and the metrics they are using to assess it. Are they sound metrics from reliable sources? Are they the right metrics for the bank’s particular situation? Are there indicators that you should be tracking but are not? Examples of metrics used to track and view trends include your area’s unemployment rate, absorption rates, home prices, housing starts, etc.

Trending the local market against a regional or national market can illuminate areas of potential concern. Also, keep in mind that unemployment rates are more of a lagging indicator, whereas metrics like absorption rates can be a leading indicator. An historical look at absorption rates leading up to the 2008 recession indicated that they began to climb in certain markets prior to the housing crisis. These kinds of insights can help your board and management adjust your risk appetite accordingly.

Based on the answers to these questions and analyses, if it is determined that the bank is facing exposures that are nearing the established limits, you may want to develop strategies to mitigate that risk. Those strategies may include more conservative underwriting, loan sales, loan participations, among others.

Market Analysis

Market analysis is an important component of portfolio management and should generally be done as part of your bank’s strategic planning. It will help your board and management to see the larger picture of trends and problem areas that may affect the bank’s risk profile. Understanding your core market – your lending area – and the metrics that affect it should already be a part of the board’s scope.

Again, those metrics may include unemployment, absorption, home prices and housing starts; they may also include more general real estate trends, including monthly and historical price trends for your market or MSA. General trend analysis can provide good insight into your market. Those metrics are important to review any time you are considering a new market or an expanded product. Monthly monitoring of trends is a proactive way to identify bubbles, risks or opportunities in the market. Beyond hard data, keeping in good communication with your lenders, real estate appraisers and agents, and local authorities can help to keep a finger on the pulse of the market.

Management Information Systems

Probably the area that is most directly related to data integrity is the management information system component. The saying “garbage-in, garbage-out” was born in the computer science world.

If you have bad data, the reports you’re getting are likely inaccurate – it’s like driving at night without headlights. For example, if the appraised value of collateral is inaccurate, you have an inaccurate loan-to-value metric. Data errors can make your system reporting meaningless if they are material and they can also mask issues in portfolio stress testing. These kinds of issues can lead to unexpected costs through poor portfolio management and costs to have third parties assist in scrubbing the data – not to mention the potential regulatory implications. If you think your data is the least bit inaccurate, it may be a valuable exercise to retroactively correct the loans already on your books. A solution may be to have internal audit conduct a sample of older loans to evaluate the accuracy of the data.

Data fields such as industry/NAICS code, geography, risk rating, loan officer, loans to one relationship/borrower, appraised value, debt-service-coverage (DSC), LTV, etc., are what drive your system reporting. Banks need the capability to track policy exceptions by type so that they can be monitored by management and the board.  If legacy issues are identified in the data, sampling and/or a data scrub may be required to validate the accuracy of your reporting capabilities. Bad data can also impact your regulatory call reports and external financial reporting which can lead to violations of law.

Stronger historical data also allows for the ability to perform trend analyses and may be useful as institutions begin to implement new allowance for loan loss requirements.

Setting up controls to ensure segregation of duties and data validation checks can go a long way towards proactively managing your MIS systems. Banks want to make sure they have controls around onboarding and segregation of duties – one person should input the data and another should check it to confirm accuracy. It is more work upfront, but being proactive and getting it right the first time will save considerable time and resources in the future.

Portfolio Stress Testing and Sensitivity Analysis

Most banks are familiar with, and do a good job of, portfolio-level stress testing, but there are some aspects unique to commercial real estate. Generally, consider stress testing interest rates, risk rating migrations, LTVs and debt-service coverage ratios. Interest rate changes will impact the DSCRs of variable rate loans through higher payment requirements and LTVs on CRE loans through changes in capitalization rates. The interaction of different external market factors on your internal portfolios should be translated to potential defaults, severity of loss and the related impacts on earnings and capital.

Another aspect to stress-testing a CRE portfolio is pre-origination testing. For example, banks may conduct stress tests by shocking pre-origination figures – such as net operating income, collateral values, vacancy rates, interest rates, etc. – up and down by 10% increments (e.g. +10%, +20%, and +30%) to evaluate impacts on key ratios, such as LTV and DSC. This will help to identify potential areas of concern and may lead to actions such as higher levels of required approval for the loan, additional collateral, additional guarantors, etc.

Credit Underwriting Standards

As competition for loans increases, risk tolerance has a tendency to increase as well.

Credit underwriting standard policies should be in place to establish specific limits and thresholds to prevent imprudence and overextension in your portfolio. Those limits should include maximum dollar amounts for loans, related borrowers and property types, maximum LTVs, debt service ratio limits.  In addition, a general overview of what loan terms are acceptable to the bank should be understood and embedded in the loan policies. They will be driven by factors such as the bank’s strategic plan, market analyses, and current portfolio levels.

Establishing sound policies and procedures early will help to protect against the risk of becoming too aggressive. They can also help identify when a bank does become too aggressive and allow for the risk appetite to be adjusted accordingly. Overextension now can harm you later, especially as interest rates rise.

Credit Risk Review Function

Establishing accurate internal loan risk ratings is a key driver of portfolio risk monitoring. The risk ratings also feed into areas such as the ALLL and external financial reporting.

Banks should engage in proactive risk monitoring. At the same time, management should stress the importance of accurate internal loan risk ratings and consider whether compensation structures are aligned with asset quality goals. If you’re experiencing significant downgrades from your independent loan reviewers, such goals are not likely aligned.

Using Agency Guidance for Better Strategic Planning

These seven topics are important to review if your bank is considering entering CRE lending or expanding your existing portfolio. Regulators will examine each category carefully; ensuring compliance before that time is well worth the time and energy. Banks with well-managed portfolios can exceed the 300% threshold without regulatory criticism. With good data and metrics to back your decisions, a strong CRE portfolio is more than achievable.

Alan D. Lloyd, CPA, is a Senior Manager in Wolf’s Audit & Assurance Services group. With over 15 years of experience planning audit engagements, preparing and reviewing work papers and analyzing financial statements, he provides external audit services to clients and is responsible for managing a team of professionals to ensure that clients receive services that are tailored to their individual needs. He can be reached at (617) 933-3356 or

Learn more about how our internal auditors provide unparalleled guidance for our clients.