The Illusion of Precision: Borrowed Assumptions in Community Bank Credit Risk Management

From March 2014 until April 2022, I had the privilege and extraordinary pleasure of serving on the Board of Directors of Bank Leumi USA, a wholly owned subsidiary of Bank Leumi, one of Israel's largest commercial banks. Among other responsibilities I served as Chair of the Risk Management Committee of the Board. Even for a bank as small as Bank Leumi USA, with only $7 billion in assets, managing risk was complex and challenging both for senior executives and board members. Most of the time quarterly Risk Committee meetings were preceded by the receipt by Board members of packages that were many hundreds of pages long — containing numerous quantitative reports and lengthy complex policies. It required creative collaboration with the Bank's senior executive in charge of Risk, to prioritize materials and set Board Committee agendas. Notwithstanding all of that, the task of sitting on the Risk Committee, actively participating and contributing, often seemed overwhelming. Having said all of that, it was a wonderful experience.

Even after leaving Bank Leumi USA's board upon the acquisition of the bank by Valley National Bank, I have continued to be deeply interested in credit risk, the challenges facing our banking system and the unique difficulties confronting board oversight at smaller financial institutions. I have continued to research and write about these issues and more recently other issues relating to financial risk more broadly defined.

A bank's Risk Committee carries an unusually broad mandate. Credit quality of the loan portfolio, duration and yield of the securities portfolio, liquidity, stability of funding, and expense ratios are among the most obvious. Any one of these can present an existential threat to the bank. Silicon Valley Bank's collapse in 2023 (which I have written about elsewhere) was a stark reminder of what happens when a Board fails in its oversight responsibilities on even one of these crucial mandates. Beyond that there is regulatory and legal compliance, BSA/KYC obligations, operational risk, and more. For a smaller commercial bank, all of this lands on a committee that is simultaneously expected to exercise meaningful oversight and not get lost in the technical weeds.

That tension is manageable in most areas most of the time. The experience of SVB notwithstanding, it is most acute, and most consequential, in credit risk — specifically in the gap between how credit risk gets measured and communicated to a board, and how well those measurements actually reflect reality.

That gap is what this piece is about.

The Formula Everyone Knows and Nobody Fully Solves

Credit risk professionals organize their thinking around a deceptively simple framework. Expected loss equals the probability that a borrower defaults (PD), multiplied by the amount exposed at the time of default (EAD), multiplied by the portion of that exposure the bank will likely not be able to recover (LGD). Every credit risk system, every loan rating, every reserve calculation is ultimately an attempt to estimate one or more of these three variables.

The formula is not in dispute. What is in dispute — or more precisely, what is rarely examined carefully enough at the board level — is the quality of the inputs.

For a large money center bank, those inputs rest on an enormous foundation of proprietary historical data. JPMorgan has originated and tracked millions of loans across multiple asset classes, geographies, and economic cycles. It can estimate, with reasonable statistical confidence, the probability that a particular type of borrower defaults under particular economic conditions. It can back-test those estimates against actual default experience. When its models produce a number, that number is imperfect, but it is disciplined and supported by decades of evidence.

A community or regional bank operating with $10 to $50 billion in assets does not have that foundation. It certainly has a narrower portfolio, concentrated in fewer loan types and geographies, with loss history that may not extend across a full credit cycle in any statistically meaningful way. It is being asked to solve the same equation, with the same apparent precision, using inputs that are fundamentally less reliable.

Where the Uncertainty Lives

The most visible manifestation of this problem is the internal risk rating system — the framework that assigns every commercial credit a grade reflecting its risk of loss. These systems typically run eight to ten grades, from pristine credits at the top through a series of deteriorating categories down to loans that regulators classify as Substandard, Doubtful, or Loss.

In principle, each grade represents a meaningfully different level of risk. In practice, at most smaller banks, the grades are assigned primarily through judgment applied to criteria rather than through statistically validated probability models. A loan officer evaluates a borrower against a set of written standards and assigns a grade. There is likely a scorecard. There is always a significant amount of discretion.

Interestingly, at Bank Leumi we took meaningful steps to move beyond this "small bank" model of risk management. Perhaps because we were the wholly owned subsidiary of a much larger bank with greater financial resources and a more sophisticated, model-based approach to risk management, we invested a tremendous amount of effort and money to develop a more rigorous, data-based risk management system. The challenge and frustration for our risk management executives became the frequent efforts by loan officers and business development executives to override the bank's statistically based model.

The consequences of the small bank model are predictable. Federal bank examiners regularly find that internal ratings are inconsistently applied across loan officers, that credits are slow to be downgraded when conditions deteriorate, and that the bulk of the portfolio clusters in the middle grades in ways that obscure rather than illuminate the actual risk distribution. These are not hypothetical concerns — they show up regularly in examination findings as Matters Requiring Attention, with corrective action required.

The deeper problem is one that examination findings cannot fully address: even a consistently applied rating system, if it is not calibrated against actual default experience, cannot reliably answer the question it is supposed to answer. Does a Grade 4 credit actually default at a meaningfully higher rate than a Grade 3? At most banks in this size range, the honest answer is: we don't have enough data to know with confidence.

CECL Made the Problem Visible

The adoption of Current Expected Credit Loss accounting — which most community and regional banks completed by 2023 — brought this data problem into sharp relief.

CECL requires banks to estimate lifetime expected losses on every loan at origination, updated each reporting period to reflect current economic conditions and forward-looking forecasts. The intellectual case for this approach is sound: it forces earlier recognition of risk and reduces the procyclical dynamic of the old incurred loss model, which required banks to build reserves rapidly in the middle of a crisis rather than gradually during good times.

But the standard assumes something many smaller banks cannot deliver: a robust foundation of historical loss data, organized by loan type and credit grade, extending across enough time to capture meaningful default experience. Without it, a bank cannot credibly estimate lifetime losses from its own experience. The formula requires inputs; the inputs require data; the data, in many cases, does not exist in the depth required.

The response, widely documented during and after implementation, was for smaller banks to rely on third-party vendor models such as Moody's, peer institution loss data drawn from public Call Reports, or the Federal Reserve's own SCALE tool — a peer-data-based methodology the Fed built precisely because it recognized that many smaller banks lacked sufficient loss history to construct their own estimates. These are legitimate tools. But applying industry-wide or peer-group loss rates to a portfolio with its own concentrations, underwriting culture, and geographic exposures introduces assumptions the board rarely examines — and that examiners themselves have cited as a source of ACL adequacy findings at community banks.

The Appearance of Rigor

In the broader sense, this is the central challenge for a board Risk Committee, and it is not unique to credit risk — it is the same challenge that appears throughout risk management and that I have recently written about in the context of measuring and managing equity risk. The instruments look well-calibrated. The process may well be disciplined. The outputs carry decimal places. None of that is the same as actually knowing.

A sophisticated and finely tuned rating system that relies on borrowed probability assumptions is still, at the end of the day, relying on borrowed data. A CECL model whose qualitative factor adjustments are difficult to defend is still producing a number that will be presented to the board as the bank's best estimate of expected credit losses. A watch list that reflects relationship-driven reluctance to downgrade is still a watch list. The machinery of credit risk management operates, and its outputs look rigorous, even when the foundation underneath them is more uncertain than the presentation suggests.

The board cannot fix this problem. The data limitations are structural, and they will not be resolved by better governance. But the board can — and should — change the nature of the conversation around credit risk in at least two ways.

First, by asking not just what the numbers are, but what the numbers rest on. Where did the PD assumptions in the ACL model come from? How do our internal ratings compare to examiner ratings historically? What does our independent credit review actually find, and what happens when it disagrees with the originating loan officer? These are not technical questions — they are governance questions, and they belong in the boardroom.

Second, by insisting on honest acknowledgment of uncertainty rather than false precision. A bank that presents its credit risk position with appropriate epistemic humility — here is our best estimate, here is the range of outcomes we cannot rule out, here is what would have to be true for the situation to be materially worse — is a bank whose board can make genuinely informed decisions. A bank that presents its credit risk position as though the outputs of its models are facts is a bank that has substituted the appearance of rigor for the reality of understanding.

The distinction matters most when it matters most — which is to say, in the early stages of credit deterioration, before the numbers catch up with what is actually happening in the portfolio. That is precisely when a Risk Committee needs to be asking hard questions rather than taking comfort in the precision of the presentation.

Understanding the limits of the available tools is not an admission of failure. It is the beginning of genuine and crucial oversight.