Our post on mortgage loan processing walks the workflow — the stages of a file from application to funding, in order. This post is about something different: what a new processor has to become good at, in what sequence, and what separates a processor whose files close on time from one whose files stall.

The distinction matters because knowing the workflow and being competent at ...

Mortgage underwriting is one of the few well-paid roles in banking with no degree requirement, no state license in most cases, and a genuine internal path from an entry-level position. It is also cyclical in a way candidates should understand before they commit — underwriting headcount expands and contracts with origination volume more sharply than almost any other role in a bank.

Both of those things are worth knowing up front. What follows is what the job actually is, what ...

VA underwriting is not conventional underwriting with a different guaranty attached. Several of its requirements have no conventional analogue, and the two that most often trip lenders new to the program — residual income and the non-allowable fee rules — are unlike anything in the agency world.

This post assumes familiarity with the underwriting fundamentals covered in our

Most community banks believe model risk management does not apply to them. The belief is understandable — the supervisory guidance was written with large institutions in view, and the word "model" suggests something more elaborate than what a $600 million bank operates.

It is also wrong in a specific and consequential way. A bank that calculates its allowance in a spreadsheet, prices loans with a tool the CFO built, screens transactions with a vendor's monitoring system, and measures ...

This post covers the written information security program — what it must contain, who approves it, and what has to be reported. Our companion post on bank cybersecurity covers the threats and the technical controls. The two are related and separate: the program is the governance artifact, and controls are what it governs.

Which Standard Actually Applies

Start here, because the

This post is about managing interest rate risk. Its companion on asset/liability management covers measuring it — earnings at risk versus economic value of equity, the deposit behavior assumptions that decide the answer, and the year-end ALCO review.

The distinction is worth keeping, because measurement is where most community bank effort goes and management is where the ...

Operational risk is the residual category, which is exactly why it is managed worst. Credit risk has a department. Interest rate risk has a committee. Operational risk is the risk of everything else going wrong, it has no natural owner, and it is difficult to quantify — so it tends to be documented rather than managed.

It is also where most banks actually lose money in ordinary years: not in a single large event, but in a steady accumulation of process failures, fraud, errors, and ...

This post is the umbrella for the risk topics covered separately in this series. Credit, operational, interest rate, liquidity, concentration, vendor, and model risk each get their own treatment; this one is about the framework that holds them together and about why most ERM frameworks do not survive contact with a real decision.

The failure mode is specific. An institution builds a taxonomy, writes an appetite statement, produces a heat map, and reports it quarterly — and when a ...