Safety Norms: Credit Analysis and Small Business Finance

1Purpose, scope, and safety principles

Credit analysis is the structured assessment of whether a small business can repay borrowed funds and whether the lender can accept the risk. Small business finance covers lines of credit, term loans, equipment financing, invoice facilities, and similar products. The harm in this field is mainly financial and legal: loss to the lender, unfair or unlawful decisions affecting applicants, exposure of personal and financial data, and fraud by applicants, staff, or intermediaries.

These norms are educational guidance. They do not replace the lender's approved credit policy, formal training, licensed systems, legal advice, or supervision by qualified professionals. They apply to analysts, underwriters, relationship managers, credit committee members, loan operations staff, and contractors who handle applicant information.

• Mandatory: no credit is approved, amended, or released without authority defined in the approved delegation matrix.
• Mandatory: applicant data is used only for the lending purpose for which it was collected.
• Recommended: prepare every file as if an examiner, auditor, or court will read it later.

2Roles, competence, and accountability

Each role needs a written description, named approval limits, and evidence of competence. The credit policy owner sets lending standards and exception rules. Analysts gather, verify, and interpret information. Approvers exercise delegated authority. Loan operations staff set up accounts and release funds. Compliance and internal audit test whether controls work and report independently of the lending line.

• Mandatory: only staff with documented training and an approved authority limit may approve or release credit.
• Mandatory: no individual may create a borrower record, approve it, and release funds.
• Mandatory: analysts disclose conflicts of interest, including family, financial, or business ties to an applicant, before work begins. The conflicted person is removed from the file.
• Recommended: supervisors periodically review a sample of closed files for judgment, documentation, and policy adherence.
• Jurisdiction-dependent: licensing, fair lending, and personnel screening requirements vary. Confirm them with compliance counsel.

3Course-specific hazards and risk assessment

Typical hazards include an applicant inflating revenue, hiding related-party debt through a second company, submitting altered bank statements, or invoicing for work never performed. Internal hazards include an analyst overriding a scorecard without written reasons, an employee changing a disbursement account, or a sales lead pressuring a favorable decision.

Rate each hazard as low, medium, or high based on likelihood and impact. Record the rating and the chosen response in the credit file: accept, mitigate, transfer, or refuse. Reassess when the product, sales channel, or applicant profile changes. Rating scales should be defined in the local risk policy, and a rating must never be lowered without documented evidence.

• High: falsified financial or bank statements. Control: obtain statements directly from the bank or accountant using contact details sourced by the lender, never from the applicant alone.
• High: changed payee bank details at disbursement. Control: callback to a number already on file before any change is processed.
• High: unauthorized access to tax, identity, or bank documents. Control: role-based access with logging.
• Medium: revenue projections without historical support. Control: compare them to tax filings, bank deposits, and receivables records where available.
• Medium: concentration of exposure in one industry or related group. Control: check aggregate exposure before each approval.
• Low to medium: calculation errors in ratios. Control: second-person check of key figures.

4Preventive controls and safe work practices

Controls should be built into the workflow so that one error or deliberate act cannot complete a loan without detection. Segregation of duties is the central control. The person who collects data should not be the only person who verifies it, and the person who approves exposure should not later change its terms.

• Mandatory: separate origination, underwriting, approval, disbursement, and servicing. Where staffing is limited, document compensating controls such as independent second review and sample audits.
• Mandatory: verify identity of principal owners and guarantors using documents and an independent check permitted by policy.
• Mandatory: verify business existence and registration through official public records or licensed databases the lender is authorized to use. Record the source of each check.
• Mandatory: accept financial statements only from the source or after confirmation with the preparer. Do not rely on edited files as the sole evidence.
• Mandatory: confirm account ownership before disbursement and record the method used.
• Mandatory: any change to payee bank details after approval requires a callback to a known number and second-person approval.
• Mandatory: policy exceptions and scorecard overrides require written rationale and approval at the level set by policy.
• Mandatory: staff must not send applicant documents through personal email, messaging apps, or personal devices, and must not accept funds into personal accounts.
• Recommended: use a standard spreading template so debt service coverage, current ratio, and leverage are calculated the same way and checked by a second person.
• Recommended: treat red flags as triggers for deeper review, including round-number revenue, inconsistent fonts or formatting in statements, sudden shifts in deposit patterns, and reluctance to provide third-party contacts.
• Recommended: use enhanced review for undisclosed related parties, cash-intensive operations, or recent unexplained ownership changes.

5Equipment, environment, information, and protective safeguards

The tools include loan origination systems, spreadsheets, credit bureau portals, document management systems, and email. Each can introduce errors or exposure. The workplace, whether branch, office, or remote setting, must keep screens and paper files out of view of unauthorized people.

• Mandatory: use only approved systems and licensed data sources. Do not copy applicant data to unmanaged storage.
• Mandatory: lock screens when leaving a workstation. Print applicant files only when needed and store or destroy them under the records policy.
• Mandatory: credit report and tax-related access must follow the permissible purpose rules that apply in your jurisdiction. Confirm with compliance before requesting.
• Mandatory: use multi-factor authentication where the system supports it and policy requires it. Never share credentials.
• Mandatory: credit models and spreadsheets must be version controlled, protected against unauthorized formula changes, and validated before use.
• Recommended: send documents only through encrypted portals or approved secure transfer. Never email full account numbers or national identifiers in plain text.
• Recommended: avoid accessing applicant data on public networks or unmanaged devices.
• Mandatory: decisions must rest on documented, permissible factors. Protected characteristics must not be used, and the basis for each decision must be recorded. Confirm fair lending rules with compliance.

6Incident reporting, emergency response, and escalation

Incidents may include suspected fraud, misdirected funds, data loss, payment system outages, or regulatory complaints. Early escalation limits loss. Staff must not investigate alone, confront the applicant, or alter records to hide an error.

• Mandatory: report suspected fraud, misdirected funds, or data loss immediately to the designated fraud, security, or operations contact.
• Mandatory: preserve evidence. Keep original documents as received, retain emails and system logs, and do not delete or overwrite entries.
• Mandatory: if funds may have reached a wrong account, notify the operations lead at once so recall procedures can start.
• Mandatory: report suspected personal data exposure to privacy or security contacts without delay. Notification duties depend on jurisdiction and must be decided by counsel.
• Mandatory: the designated compliance officer decides whether suspicious activity reports or similar filings are required. Do not tip off the applicant or discuss the concern outside the approved chain.
• Recommended: log near misses, such as a bank detail change stopped at callback, so patterns can be reviewed.
• Emergency: if anyone is in immediate danger, contact local emergency services first and then notify management.

7Records, training, and documentation

Records are the evidence that controls worked. Each credit file should show the purpose, sources, calculations, verifications, decision, approver, conditions, and any exceptions. Training keeps judgment and controls current. Keep file notes short, factual, and sourced so another reviewer can follow the reasoning without asking the analyst.

• Mandatory: credit memos state the recommendation, key risks, mitigants, and conditions precedent.
• Mandatory: correct records by attributed amendment that keeps the original entry visible. Never overwrite.
• Mandatory: complete training on credit policy, fraud typologies, privacy, and escalation before handling live applications, and refresh it periodically.
• Recommended: reconcile loan system balances to the general ledger periodically and investigate differences in writing.
• Jurisdiction-dependent: retention periods and record formats are set by law and policy, and vary by location.

8Monitoring, review, and continuous improvement

Controls degrade without testing. Use periodic sampling of approved loans, exception reports, override trends, and callback logs to test whether controls operate as written. Findings should result in assigned actions with owners and follow-up. Each finding should be closed with evidence rather than a verbal assurance.

Review these norms when products, systems, or legal requirements change. Use this document as a starting point for locally approved procedures, and verify current laws, regulator expectations, and lender policy with competent authorities or qualified professionals.

• Mandatory: report control failures to the policy owner and record corrective actions.
• Recommended: track override rates and exception trends by analyst and branch to spot concentration.

Implementation checklist

• Confirm each credit decision has an approver within delegated authority.
• Verify business existence, ownership, and guarantors from independent sources.
• Confirm financial statements directly with the source or preparer before relying on them.
• Call back a known number before processing any change to bank details.
• Document every policy exception with rationale and approval.
• Keep analysis and disbursement duties with different people.
• Send applicant data only through approved, encrypted channels.
• Lock workstations and limit printed applicant files.
• Escalate suspected fraud or data loss immediately without tipping off the applicant.
• Preserve original documents and log near misses for periodic review.