Banking • Internal Audit • Risk • Governance

Expected Credit Loss (ECL) is usually discussed in the language of numbers—provisions, probabilities, scenarios, stages and financial impact. But behind every ECL number lies something far more complex: data, models, assumptions, judgements, overrides, approvals and accountability.

As financial institutions strengthen forward-looking credit loss assessment, an important question is emerging: Who provides assurance over everything that happens before the final ECL number is reported?

An ECL figure is the outcome of multiple interconnected decisions and data points—from borrower information and credit behaviour to Probability of Default (PD), Loss Given Default (LGD), Exposure at Default (EAD), Significant Increase in Credit Risk (SICR), stage classification, economic scenarios, model assumptions and management overlays.
The assurance question therefore cannot stop at: “Was the ECL calculated correctly?” It must also ask: “Was the process that produced the number adequately governed?”

ECL calculations depend on data drawn from multiple systems and processes. The challenge is not simply whether data is available. It is whether the institution can demonstrate where the data came from, how it was transformed, what validations were performed, and whether any changes occurred before it entered the ECL calculation.

For Audit and GRC, this creates an assurance agenda around source-system integrity, completeness and accuracy, reconciliation, manual interventions, ownership, exception handling and change history.

The key question is simple: Can the institution trace a material change in ECL all the way back to the underlying data and decision that caused it? If the answer requires multiple teams, spreadsheets, emails and manual reconciliations, the governance challenge may be bigger than the calculation itself.

Movement between Stage 1, Stage 2 and Stage 3 can materially influence expected credit losses. But stage migration is not merely a technical classification—it represents a judgement about deterioration or improvement in credit risk.

Internal Audit can independently examine unusual stage movements, delayed migrations, inconsistent classifications and cases where underlying risk indicators appear misaligned with the assigned stage. The objective is not simply to verify classification, but to assess the governance and consistency of the decisions behind it.

Significant Increase in Credit Risk is a critical point in the ECL framework because it can change the basis on which loss allowances are measured. Institutions may use quantitative and qualitative indicators to determine whether credit risk has increased significantly.

Audit and GRC can examine whether SICR criteria are clearly defined, consistently applied, appropriately documented and subject to controlled override and approval. The real assurance opportunity lies in identifying the gap between policy and actual practice.

Not every emerging risk can be fully captured by historical data or existing models. Management overlays may therefore be necessary—but they introduce an important governance dimension.

Who proposed the overlay? What evidence supported it? What was its financial impact? Who challenged and approved it? How long should it remain? What would trigger revision or removal?

The objective is not to eliminate management judgement. It is to ensure that judgement is explainable, traceable, challengeable and accountable.

As ECL models evolve, institutions may operate with multiple model versions, parameter updates, scenario assumptions, recalibrations and validation cycles. Strong governance should make it possible to demonstrate exactly which model, version, parameters and assumptions produced a particular ECL outcome.

This aligns closely with RBI’s proposed direction: its 2023 discussion paper envisaged bank-developed ECL models subject to independent validation, including assessment of sound reasoning, relevant data, back-testing and internal validation.

For Internal Audit, the opportunity is to assess not only whether model-governance policies exist, but whether the complete lifecycle of model changes, validation, approvals and exceptions is controlled and reconstructable.

Forward-looking information is fundamental to ECL. Economic conditions, sector outlooks and other macroeconomic factors can influence expected losses.

This raises governance questions around who selects scenarios, how they are weighted, what evidence supports assumptions, how often they are reviewed and what happens when actual conditions diverge from expectations.

The growing attention to this area is visible even in professional education: ICAI’s Accounting Standards Board scheduled dedicated 2026 sessions on ECL under Ind AS 109 and on incorporating macroeconomic scenarios into forward-looking ECL information.

Senior management and governance committees need more than a headline ECL number. They need to understand the drivers: borrower exposures, stage migration, PD/LGD movements, sector or geographic concentration, scenario changes, model recalibration and management overlays.

The assurance opportunity is to connect the reported outcome to the decisions and risk drivers underneath it. This gives Audit and GRC a stronger basis to challenge material movements and help governance forums focus on what truly changed.

In a complex ECL environment, one of the most valuable governance capabilities may be the simplest: knowing who did what, when and why.

Who changed a parameter? Who approved a stage movement? Who authorized an override? What was the previous value? What justification was provided? Which supporting documents were considered?

A strong audit trail enables Internal Audit to reconstruct decisions rather than simply review outcomes. For management and governance committees, it strengthens transparency and accountability.

ECL sits at the intersection of Finance, Credit Risk, Model Risk, Business, Internal Audit and GRC. When these functions operate in silos, the process can become fragmented.

The opportunity is to create a connected governance ecosystem where relevant data, assumptions, decisions, exceptions, approvals and assurance activities form part of a single risk narrative. The goal is not to make every function responsible for ECL; it is to ensure every function has the visibility and accountability appropriate to its role.

The growing complexity of ECL presents an important opportunity for Internal Audit and GRC. Internal Audit can extend its focus beyond validating the final output to providing assurance over the integrity of the processes, controls, judgements and governance that produce it. GRC can provide the structure that connects policies, responsibilities, approvals, exceptions, documentation and accountability across the ECL lifecycle.

The questions are no longer only “What is our ECL?” They are also: Why is it changing? What decisions influenced it? Are those decisions consistently governed? Can we trace and explain them? Can we independently assure the process behind the number?

ECL may ultimately appear as a number in financial reporting. But confidence in that number depends on everything behind it. For financial institutions, the next opportunity is not simply to improve how ECL is calculated. It is to strengthen how ECL is governed, challenged, explained and assured—and that makes it an increasingly important area for Audit and GRC.