The Greek philosopher Heraclitus taught that “Everything changes and nothing stands still,” i.e., nothing is permanent except change. But he never met SBA’s Independent Loan Review Guide of 2017.  I was reading through Version 2.0 the other day. Although it’s dated 10/16/2017, it’s the most recent one I could find.

With all the recent changes in SOPs, I expected several re-issuances within the last seven years. Not so. Much to my surprise, the only thing changed since the 2017 Guide was issued is that the Independent Loan Review (ILR) is now required every other year, not annually.1 So, while CFRs and SOPs have been changed, amended and re-issued over and over again, Independent Loan Reviews have remained a constant.

Check out your Internal Control Policy and your Loan Review Policy. At JRB, we’ve written many eBulletins reminding you to review your Internal Control Policy to make sure it incorporates recent changes in SOPs and CFRs. But in the midst of that review, remember: Your Loan Review Policy is part of your Internal Control Policy. Does your Internal Control Policy contain the requirements for ILRs?

The regulatory background to the ILR begins with 13 CFR § 120.823(d)(13) and 13 CFR § 120.826(b)(3), which mandate loan reviews. SOP 50 10 6  limited the required loan review to one every two years, and SBA Form 1253 (CDC Annual Report Guide) requires a CDC to include the Loan Review in its Annual Report. The key words here: Required Loan Review. If your Internal Control Policy still requires annual reviews but you’re performing them only every other year, you have a policy violation. You need to amend your Internal Control Policy or require annual loan reviews.

How often you have an Independent Loan Review is up to your CDC. The point is to include the particulars regarding your Independent Loan Review in your Internal Control Policy.

Loan Review requirements …

  • The Guide doesn’t require the reviewer to be an outside contractor, but it does require a CDC’s Annual Report to include a description of the person(s) doing the review and, if performed internally, a demonstration that they are independent of the function they’re reviewing.
  • SBA doesn’t specify a methodology for selecting the loans to be reviewed. Nor does it require a certain checklist to be used in the review. However, you need to include both your methodology and your checklist in the Loan Review. Check your Loan Review Policy to make sure it covers both.

Internal Control Policy requirements …

  • Your policy must specify the sampling methodology for loans and appraisals originated within the last 12 months for underwriting/closing requirements. Although your Policy might consider loans originated in the last three (3) years as new loans, and other loans as “Legacy Loans,” the term, “Legacy Loan” is not defined by SBA in regulation 13 CFR § 120.or in SOP 50 or 50 56. The Guide makes clear that new loans are those that originated within the last 12 months, but there is no reference to “Legacy Loans.” Make sure your Policy is consistent with the Guide.
  • You must include the sampling methodology for reviewing loans in servicing in your Internal Control Policy. Base this on loans that are current, delinquent, in intensive servicing or in liquidation. Include loans on deferral and on catch-up plans. Technically, these types of loans are considered “current” but should be included as a sub-type.
  • Be sure your Internal Control Policy includes requirements for reviewing loan-related collateral and appraisals, work papers and supporting documentation ─ and importantly, your risk-rating standard.
  • And finally, be sure to include specific control requirements for your CDC’s oversight of Professional Services Contractors, and standards for training to implement the loan review program.

Well, I never thought thumbing through an SBA Guide circa 2017, would grab my attention. Yet it did. And it serves as a reminder to give your internal policies a check-up. Just in case!

Richard Jeffrey, Senior Associate
CDC/504 Program

1 SOP 50 10 6 p. 88