Running Underwriting Exceptions Without Losing the Audit Trail

Not every underwriting step can bend under deadline pressure, but pretending none of them can is how a deal desk starts quietly skipping steps instead of documenting exceptions. Decide in advance which conditions are true hard stops, verified collateral value, for instance, and which can proceed with a documented, approved exception and a follow-up deadline. Build both paths into the checklist rather than leaving the exception path as an off-system workaround.

A Process Street checklist that only has a single pass-or-fail path for each condition forces people to either wait or go around the system entirely. Add a branch: condition met, condition waived with documented approval and a cure deadline, or deal held. That third option, visible and tracked rather than informal, is what actually protects the file later. Give the exception path its own required fields, reason, approver, cure deadline, rather than a free-text comment box, so the resulting log is something you can filter and report on rather than a pile of notes someone has to read one by one before an exam.

The checklist enforces sequence; it should not be where someone looks up what actually qualifies as acceptable collateral documentation or what threshold triggers a second-level review. Keep that policy content in a procedure library the checklist steps reference, so updating the policy does not mean rebuilding the checklist, and an underwriter working a live deal can pull up the current standard without leaving their workflow.

Post-closing monitoring, the borrowing base certificates, the periodic field exam, the covenant compliance check, is where files drift furthest from policy, because the urgency of the closing deadline is gone and monitoring competes with new originations for attention. Run it as its own recurring checklist tied to a calendar, not a task someone remembers to revisit. A deal desk under origination pressure will always deprioritize monitoring in favor of new business unless the monitoring calendar runs independently of whoever is busiest that week.

Every documented exception, who approved it, why, and what the cure deadline was, should roll up into a single log an examiner can review without pulling individual files one at a time. This is the difference between a lender that looks like it manages exceptions deliberately and one that looks like it is hiding them, even when the underlying exception rate is identical. Review the log itself on a schedule too, not only when an exam is imminent. A rising exception rate on a specific condition is usually the first sign that condition needs to be reconsidered or that a specific originator needs closer supervision, and that signal is easy to miss if the log only gets pulled up once a year.

Each logged exception should capture these details:

• The condition that was waived, and whether it was a hard stop or a condition allowed to proceed under a documented exception.
• The named approver, recorded in the same system as the exception rather than in an email thread.
• The reason the exception was granted, written clearly enough that an examiner does not have to ask why policy was not followed.
• The cure deadline and the follow-up owner, so the exception is tracked to closure instead of forgotten after funding.

Median pay for an operations manager, often the role that ends up owning this kind of compliance system, runs $105,770 a year nationally¹, a reasonable anchor when deciding whether to build this ownership into an existing credit-team role or budget for a dedicated hire. Either way, name the owner explicitly rather than leaving exception tracking as a shared responsibility that quietly becomes nobody's job during a busy quarter.

An examiner who finds an undocumented deviation from stated underwriting policy treats it very differently depending on whether your file shows an approved, dated exception with a named approver, or shows nothing at all and forces them to ask why the policy was not followed. The gap between those two outcomes is almost entirely a matter of whether the exception was logged in the moment, which is why the logging step has to be built into the checklist itself rather than left as a task someone does later if they remember.

The same logic applies to post-closing monitoring gaps. A covenant check that ran two weeks late with a documented reason reads as a manageable operational hiccup. The same check that simply never happened, with no record either way, reads as a control failure, even if the underlying credit risk turned out fine.