Frequently Asked Questions About Strunk’s GRC and Compliance Software

Strunk builds compliance and profitability software specifically for community banks. Our core products — Risk Manager, Pricing Manager, and Overdraft Privilege — are designed to help your institution manage regulatory requirements, optimize loan and deposit pricing, and run a sustainable overdraft program. If you have a question about how any of these tools work, what implementation looks like, or whether Strunk is a fit for your bank, you’ll find the answers below.

SCHEDULE DEMO

Loan-level profitability analysis determines whether each loan generates adequate return after accounting for funding costs, credit risk, overhead, and capital allocation. Without it, banks often misprice loans—accepting unprofitable relationships or losing competitive deals unnecessarily. It enables relationship managers to set rates that meet target ROE thresholds, supports exception pricing decisions with objective data, and helps leadership identify which loan types, officers, or markets are diluting overall portfolio profitability.

Regulators assess fair lending risk in loan pricing by examining whether similarly qualified borrowers receive comparable rates and terms regardless of protected class status. Examiners review pricing exception frequency and approval rates by demographic group, look for documented justification on every exception, and test whether pricing discretion is consistently applied. Banks without a structured, documented pricing model—including exception tracking tied to objective criteria—face higher scrutiny and potential ECOA or Fair Housing Act findings.

The most common exam findings stem from undocumented processes, inconsistent policy application, and lack of audit trails. Specific gaps include: pricing exceptions approved without written justification, risk assessments not updated on a defined schedule, compliance monitoring that is manual and infrequent, missing or outdated policies relative to current products, and board/committee reporting that lacks sufficient detail. Examiners look for evidence that controls are operating—not just that they exist on paper.

A credit union risk committee should receive, at minimum: loan portfolio concentration and growth trends, delinquency and charge-off rates by product, pricing exception volume and approval rates, fair lending disparity metrics, policy exception tracking, compliance audit findings and remediation status, and interest rate risk exposure relative to policy limits. Reports should be comparative (month-over-month or quarter-over-quarter), include variance explanations, and flag items requiring committee action or escalation.

A repeatable, auditable loan approval process requires four elements: standardized risk scoring criteria applied consistently across similar loan types, documented decision rationale captured at the time of approval, a defined approval authority matrix tied to loan size and risk grade, and a system of record that timestamps each step. Exception approvals must be logged separately with written justification. Periodic back-testing of decisions against outcomes closes the loop and demonstrates process integrity to examiners.

A rules-based approach uses fixed criteria—minimum credit score, maximum LTV, debt-to-income thresholds—to approve or decline loans. It is transparent and easy to audit but may be too rigid to capture nuanced borrower risk. A model-based approach uses weighted variables to produce a composite risk score, allowing more differentiation across borrowers. Community lenders often combine both: models inform pricing and risk grading, while rules establish hard floors. Either approach requires documentation and consistent application to satisfy fair lending requirements.

The most critical inputs for a community bank or credit union loan pricing model are: cost of funds (by funding source), credit risk premium (based on internal loss history or risk grade), loan servicing and origination costs, target return on equity or assets, and loan term and repricing structure. Secondary inputs include prepayment assumptions, collateral type, and relationship value (deposits, other products). Models built without accurate internal cost data typically underprice risk and erode margin over time.

Examiners most frequently cite: failure to provide clear opt-in disclosures for ATM and one-time debit card transactions, inconsistent application of overdraft fees across similar accounts, inadequate monitoring of high-frequency overdraft users as required under UDAAP guidance, misleading marketing materials, and lack of documented procedures for the overdraft program. Regulators also scrutinize re-sequencing of transactions that maximize fee income and programs that lack a defined limit or cooling-off period for chronic users.

Compliant, member-friendly variable-rate repricing requires: clear disclosure of the index, margin, and adjustment frequency at origination; advance notice of rate changes as required by Regulation Z; and consistent application of the repricing formula without discretionary adjustments. Member-friendly practices include providing plain-language explanations of how the new rate was calculated, offering rate cap protections where feasible, and proactively communicating changes before they appear on statements—reducing complaints and preserving trust.

Community banks protect net interest margin on fixed-rate loans by pricing off the relevant point on the Treasury or swap curve matching the loan’s duration, adding a spread that covers credit risk, operating costs, and target return. Stress-testing pricing assumptions across rate scenarios—rising, flat, and falling—before booking loans is essential. Banks also use loan-level profitability tools to ensure fixed-rate volume doesn’t create excessive duration mismatch relative to their funding base, which can compress margin when rates rise.

An independent certified public accountant has examined Strunk’s operations and found them to be in compliance with the AICPA’s Trust Service Principles. It was determined that Strunk meets the Security, Availability, Processing Integrity, Confidentiality, and Privacy criteria for SOC 2 established by the AICPA.