Separate quality assurance from individual underwriting
An underwriter's approval is an individual decision. Quality assurance checks whether the lender's procedures consistently satisfy the applicable requirements across products and customer groups. It should sample cases where the system approved credit as well as declined it, because overly permissive decisions may produce harm without an immediately visible complaint. The review team should understand the product terms and governing law rather than apply a generic global scorecard. Define the audit population, sampling method, assessment dates and rules in effect. Check whether the decision can be reproduced from retained evidence, whether the offered agreement matches the assessed repayment commitment and whether the reason recorded for a decision reflects the actual information considered. Build controls around both human and automated credit decisions.
Risk-based sampling that does not hide outliers
Random sampling helps identify ordinary process failures, but should be combined with targeted tests of high-risk conditions. Review irregular incomes, newly opened debts, conflicting applications, repeated borrowing, material credit limit increases and customers with signs of repayment difficulty. Include cases involving different channels, brokers, external credit data vendors and automated model versions. Check customer groups that have limited bureau records or unusually complex household spending. Sample declines and notices, including whether adverse-action reasons match decision inputs where the law requires them. Make sampling rules explicit and preserve why particular cases were selected. A monitoring program based only on defaulted accounts may miss overburdened consumers who remain current by cutting essential spending.
EU and UK compliance review points
For EU lending, record the existing Member State creditworthiness rules and the revised CCD2 requirements as they commence. Directive (EU) 2023/2225 Article 18 focuses on assessment before relevant lending, while new national implementing provisions generally apply from 20 November 2026 subject to transition. Verify that the creditor uses the correct legal regime for the decision date. In the UK, FCA CONC 5.2A addresses reasonable creditworthiness and affordability-risk evaluation. Quality assurance should test whether information and verification steps were proportionate and whether records demonstrate a reasoned conclusion. Do not treat the same document checklist as legally sufficient across every UK or EU product. Review third-party dependencies and whether changed information sources alter the quality of underwriting evidence.
US fair-lending and notices
US quality assurance should map the actual product to ECOA, Regulation B, applicable FCRA requirements and any product-specific rules. Review potentially discriminatory decision criteria and adverse-action notice practices under relevant law. Regulation B section 1002.9 requires covered notices to present principal reasons actually used in the decision. Test whether automated reasons remain accurate after model updates and whether customer report information was handled with proper access and dispute procedures. Different notice rules can apply to new applications and existing accounts. Mortgage ability-to-repay requirements under Regulation Z need separate testing where applicable. Avoid drawing legal conclusions solely from aggregate approval-rate differences without careful analysis, but investigate unexplained patterns and possible proxies for prohibited characteristics.
Monitoring model drift and repayment stress
Operational monitoring should track data completeness, estimates, exception rates, manual overrides, model drift, customer complaints and subsequent payment stress. A low observed default rate does not prove that all applicants were assessed responsibly. Changes in borrower circumstances, economic conditions or supplier categorisation may degrade model performance. Establish thresholds that trigger deeper file sampling or a model review, and record the evidence behind them. Compare different underwriting versions and product cohorts without revealing unnecessary personal data. Assess whether smaller consumer-credit amounts or BNPL instalment arrangements lead to clustered obligations that the original process did not fully capture. Escalate a suspected systemic issue to legal, risk, compliance and servicing owners, with clear responsibility for containment and remediation.
Remediation and continuing governance
When a review detects missing evidence or a defective model rule, preserve affected decision records, identify the relevant population and assess whether immediate controls should be paused. Determine whether customer communication, reassessment or regulatory notification is required under the applicable rules. Document the root cause, corrective action, responsible owner and verification of completion. A repaired model should undergo regression tests covering cases similar to the failures as well as normal applications. Update training and third-party agreements where necessary. Periodically audit the assurance process itself to ensure that it can challenge commercial pressures and that its findings are not quietly closed. Quality assurance is successful when it improves the reliability and lawful operation of real lending decisions, not when every dashboard indicator is green.
Example: quality assurance finding and resolution
Suppose sampling reveals that an income classification model incorrectly treats periodic reimbursements as recurring earnings. The assurance reviewer should capture affected model versions, relevant products and decision dates, then assess whether any approvals relied materially on the mistake. The creditor may need to pause a particular automated route while it validates a corrected method. A remediation log should document the legal assessment, customer-impact analysis, testing owner, changed control and evidence that the fix works. Review whether the error also affected rejection explanations or led to inconsistent treatment across customer groups. Compare the revised process with representative scenarios for irregular income and account transfers. The response should be proportionate to actual risk and regulatory duties, not simply an undocumented vendor patch.
Frequently asked questions
Does a credit score establish compliance?
No. It is one possible input; the creditor must satisfy the applicable assessment and recordkeeping requirements.
Are requirements identical in the EU, UK and US?
No. Scope, triggers, decision rights and notice duties are jurisdiction-specific.
When do revised CCD2 measures generally apply?
From 20 November 2026, subject to national implementation and transition.
Primary sources
Directive (EU) 2023/2225 ↗FCA CONC 5.2A ↗CFPB Regulation B Section 1002.9 ↗CFPB Regulation B Section 1002.12 ↗Read the source in its current version. National implementing measures and product-specific applicability may require additional research.