Consumer credit and the regulatory framework governing it have been the subject of active debate for years. On the one hand, there are questions about whether the current requirements are too strict and restrict creditors’ activities. On the other, there are concerns about whether existing controls are sufficient to ensure responsible lending and protect consumers from excessive debt and payment difficulties.
Today, customers expect fast, simple and convenient service. This means creditors need to strike a balance between regulatory compliance, risk management and a good customer experience. As loan decisions are made increasingly quickly, several questions become more important: how effective are the organisation’s internal controls? Are the principles for assessing creditworthiness clearly established and consistently followed? Are lending decisions sufficiently documented and justified? And do the creditor’s processes work in practice as described in its internal procedures?
As an internal auditor, I frequently encounter these questions and see the same weaknesses recurring regardless of an organisation’s size or business model. Below, I highlight five common shortcomings I have identified when auditing creditworthiness assessment processes. Addressing these issues can help creditors not only meet regulatory requirements, but also reduce credit risk and strengthen consumer trust.
1. Irregular or unsuitable income is included when assessing customer income
One of the most important stages of a creditworthiness assessment is correctly evaluating the consumer’s income. Under the principle of responsible lending, the creditor must assess the customer’s regular income and ensure that it is sufficient to meet credit obligations throughout the loan term. This means assessing not only the amount of income, but also its regularity and stability.
When testing loan files as an internal auditor, I often see irregular payments included as income. These may include expense reimbursements paid by an employer, travel allowances, vehicle allowances, daily allowances or performance bonuses that are neither regular nor guaranteed. Treating such payments as regular income may distort the picture of the consumer’s ability to pay. As a result, their actual capacity to meet credit obligations may be overestimated.
The underlying problem is often that the company has not clearly defined which types of income may be included in a creditworthiness assessment. As a result, different credit analysts may make different decisions in similar cases. Automated credit assessment systems may also classify irregular payments as regular income if the necessary parameters have not been configured.
To avoid this, creditors should establish clear and consistent rules defining which types of income qualify as stable income and when irregular income should be treated more conservatively or excluded from the creditworthiness assessment altogether. Automated creditworthiness assessment systems should also include effective parameters for identifying such income. This helps ensure consistent lending decisions, reduce credit risk and demonstrate to supervisory authorities that responsible lending principles are followed in practice.
2. The approach to household and dependant expenses is not sufficiently justified
Assessing a consumer’s ability to pay requires more than analysing income. It is equally important to assess their regular monthly expenses. I often find that internal procedures do not describe clearly enough how household expenses and costs related to dependants should be calculated.
For example, procedures may not clearly define when actual customer expenses should be used and when standardised expense rates are appropriate, how households of different sizes should be treated, or how costs related to dependants should be assessed. In some cases, the expense rates used are based on outdated statistics and no longer reflect the actual cost of living.
Overly optimistic assumptions may result in the consumer’s disposable income being assessed as higher than it actually is, leading to an overestimation of their creditworthiness. Good practice is to establish clear and well-founded methodologies for calculating household and dependant-related expenses, set reasonable rates for different types of expenditure, review these rates regularly and document the assumptions behind them. This helps ensure that lending decisions are based on a realistic assessment of the consumer’s actual ability to pay.
3. Future risk assessments often focus only on the present
When assessing creditworthiness, creditors generally focus on the consumer’s current income and obligations. Much less attention is paid to how the consumer’s ability to pay could change over the term of the credit agreement. For long-term credit agreements in particular, it is important to consider possible future changes, such as reaching retirement age, a reduction in income or an increase in other financial obligations.
Such sensitivity analyses are either not performed or are limited in scope. In many cases, there is no consistent methodology for conducting them. Without realistic scenario analyses, it is difficult to assess the consumer’s future ability to pay.
Good practice is to establish clear principles defining when a customer’s future ability to pay must be assessed, which risk factors should be considered, how the assessment should be carried out and how it should be documented. This supports better-informed loan decisions and reduces the risk of the customer’s ability to pay deteriorating significantly during the credit term.
4. Internal procedures and actual practices do not align
One of the most common shortcomings is a mismatch between an organisation’s internal procedures and the way work is actually carried out. Internal procedures are often created by reproducing regulatory requirements and may therefore include requirements or processes that do not actually apply to the company’s business model. In other cases, the procedures have simply become outdated: processes have changed, but the documentation has not been updated.
In practice, this means employees follow one set of rules while the documentation describes another. Even if the actual process complies with the law and works well, this discrepancy creates several practical risks. New employees may not receive consistent training, similar cases may be handled differently, and process consistency may depend on individual employees’ experience rather than common principles established by the company.
It also becomes more difficult to monitor the effectiveness of controls, improve processes and implement changes. If actual practices are not documented, it is harder for the company to demonstrate to internal audit or supervisory authorities that creditworthiness assessments are conducted in a considered, consistent and controlled manner.
The purpose of internal procedures is not to reproduce legislation. Good internal procedures describe clearly and practically the activities that are actually performed within the company, assign responsibilities and explain how regulatory requirements are implemented in the organisation.
Internal procedures should be reviewed regularly and updated whenever processes, systems or regulatory requirements change.
5. Automated credit assessment systems are not sufficiently documented
An increasing number of creditors use automated decision-making and assessment systems to evaluate creditworthiness. These systems make the process faster, reduce manual work and help ensure more consistent decisions. However, as an internal auditor, I often find that internal procedures do not describe how these systems work in sufficient detail.
For example, system documentation may not make it clear which data the system uses, how it assesses the consumer’s income and obligations, which criteria determine automated decisions, or when a credit application is referred for manual review.
Good practice is to describe in internal procedures the role of automated systems in creditworthiness assessments, their key decision-making logic and the controls that ensure decisions comply with responsible lending principles. The description should be detailed enough for a third party to understand how the system carries out the creditworthiness assessment and reaches its result. It should also enable the process to be replicated manually based on the documentation and produce the same outcome.
This increases transparency and helps demonstrate that automated decisions are justified and subject to appropriate controls.
If any of these observations sound familiar, it may be time to review your creditworthiness assessment process with fresh eyes. In day-to-day operations, familiar weaknesses can easily go unnoticed. Internal audit can help assess whether internal procedures, actual working practices, automated systems and controls are aligned and support responsible lending principles. An independent perspective can identify areas for improvement, reduce regulatory and credit risk, and make the process more transparent, efficient and reliable.
