What is underwriting?

It starts with intake: the application is captured with consent for data checks and KYC identity checks. Verification follows, covering identity, income, employment, bank statements, asset documents and collateral titles, with evidence and timestamps kept for the audit trail. Scorecards, rules and models then estimate PD, LGD and EAD, with manual judgment applied to edge cases.

The decision is to approve, decline, refer or approve with conditions, recorded with reason codes. Pricing and conditions are applied from the pricing grid, including any surcharges, discounts, covenants and documentation requirements. The contract is prepared, terms disclosed and signatures secured, and the account is onboarded with monitoring triggers and a link to collections workflows if needed.

Internally, underwriters draw on application history, customer files, transaction records and previous decisions. Externally they use credit bureau reports, bank statements and transaction feeds through open banking where available, tax records and payslips, property valuations and title registers, trade references, public registers such as court records, identity verification providers and fraud signals from devices and behaviour.

Data quality matters as much as quantity: stale or incomplete data undermines the decision, consent records must be kept, and material facts such as income, employment and ownership are corroborated from more than one source. Qualitative factors round out the picture: industry experience, the resilience of the business model, borrower reputation, concentration risk and covenant strength.

Automated decisioning combines rule engines for deterministic checks, scoring models, an orchestration layer that blends rules, models and human review, real-time fraud detection, and audit trails with explainable outputs and override controls. It is faster, more consistent and scales with volume, but it needs a human in the loop for edge cases and appeals, monitoring for model drift, periodic revalidation and exception workflows for complex files.

APRA sets the prudential expectations and ASIC the responsible lending obligations, disclosure and conduct rules, while the OAIC oversees privacy and consent when bureau or bank data is pulled. Firms document the rationale for each decision, retain records, test models for bias and fairness, and keep escalation paths for complaints and disputes.

Lenders lean on a handful of measures. The approval rate shows how much business is getting through, and whether policy has quietly loosened or tightened. Vintage default rates follow each month's lending as it ages, so weak underwriting shows up early rather than at the end of the book. The override rate counts the decisions staff changed by hand, and expected versus actual losses tests whether the models are still calling the risk correctly.

The common failures are overfitting models to history without stress tests, ignoring data quality, tolerating high override rates without root-cause analysis, and neglecting privacy and consent obligations on third-party data.