Data governance and third-party oversight: Key risk areas for specialty finance companies

While loan-level data is fundamental to internal and external financial reporting, specialty finance companies also rely on it to support underwriting, servicing, credit loss models, and fair value measurements. When data is inaccurate, incomplete, or not properly monitored, the consequences extend beyond operational inefficiencies to misstated financial reporting, distorted valuations, and flawed management decisions.

The challenge intensifies in high-volume lending environments where data flows across multiple systems and third-party service providers. Each system handoff, data transfer, or manual adjustment introduces risk. Even small errors, when repeated across thousands of loans, can accumulate into material issues.

This article outlines where data quality and third-party control breakdowns most often occur in high-volume lending organizations and highlights practical steps companies can take to strengthen oversight and reduce audit risk.

Why Data Quality Is a Financial Reporting Risk

Specialty finance companies often manage thousands of small‑balance loans across automated underwriting systems, separate origination and servicing platforms, and multiple reporting environments. Loan‑level data frequently feeds directly into current expected credit loss (CECL) models, fair value measurements, and internal reporting, often through data warehouses or spreadsheets.

Since CECL and fair value models rely heavily on this data, auditors examine data lineage from source systems to model inputs, including controls over extraction, transformation, and validation of key fields. This becomes even more complex for acquired portfolios subject to updated CECL guidance, such as the gross‑up requirements introduced under ASU 2025‑08.

In these environments, small mistakes can multiply quickly, affecting:

• Interest income recognition
• Loan balances and aging
• Charge-offs and recoveries
• CECL allowances or fair value estimates
• Investor reporting and covenant compliance

What Auditors Look For

In high‑volume lending environments, audit risk tends to concentrate at a few recurring points in the data lifecycle. Since small issues can create downstream reporting and valuation challenges, these are the areas auditors examine most closely:

Loan Boarding

Loan boarding is one of the most common sources of downstream issues. Audit questions often include:

• Are all loans accurately recorded on the point-of-sale or servicing platform post origination?
• Are the key terms (interest rate, term, fees, collateral, payment schedule) correct?
• Were manual overrides or data edits made without proper approval?

Errors at this stage affect every downstream process, from income recognition to credit modeling.

Data Transfers Between Systems

In high-volume environments, system interfaces are frequent audit focus areas. Auditors look for evidence that:

• Data transfers between origination, servicing, and data warehouse systems are complete and accurate
• Reconciliations between systems are performed and reviewed
• Batch failures or skipped files are identified and resolved
• IT change management controls are in place to prevent unauthorized or erroneous changes to reporting parameters

The expectation extends beyond confirming jobs run to validating the results.

Data Used in CECL / Fair Value Models

Since CECL and fair value models rely heavily on loan-level data, auditors examine:

• Data lineage from source systems to model inputs
• Controls over data extraction and transformation
• Validation of key fields (FICO, origination date, delinquency status, charge-off history)
• Change management over model inputs

Model outputs are only as reliable as the data supporting them.

Manual Adjustments and Overrides

Manual activity introduces additional risk, particularly in spreadsheet-based environments. Common audit questions include:

• Are post-close journal entries documented and approved?
• Is non-system-generated activity monitored?
• Are spreadsheet-based calculations reviewed?

Without clear review and documentation, manual adjustments are difficult to defend during audit.

How Companies Can Improve Data Governance

To maintain control in high-volume lending environments, specialty finance companies often benefit from:

• Mapping data flows from loan origination to financial statement presentation
• Performing regular reconciliations among origination, servicing, data warehouse, and reporting systems
• Formalizing data validation checks at intake and when reports are made
• Implementing structured review processes over model inputs and outputs
• Reducing reliance on uncontrolled spreadsheets

These steps help turn data quality from an informal practice into a controlled, repeatable process that supports reliable reporting, valuations, and business decisions.

Third-Party Servicing and Data Risk

Many specialty finance companies rely on third-party providers for servicing, collections, loan platforms, hosting, and data storage. While these arrangements support scale, they introduce additional financial reporting and control risks. Outsourcing does not transfer responsibility. Management remains accountable for data accuracy and reporting outcomes.

Auditors assess whether third‑party reliance is supported by effective oversight and controls across several areas:

SOC Reporting

Auditors ask:

•  Is there a SOC 1 report available?
• Does it cover relevant financial reporting controls?
• Are complementary user entity controls identified and implemented?
• Are there control deficiencies noted that impact financial reporting?

SOC reports support reliance but do not replace internal controls.

Monitoring Servicers

Auditors expect evidence that management actively monitors third-party servicers, including:

• Periodic performance reviews
• Reconciliations of servicer reports to internal records
• Tracking and resolution of exceptions
• Monitoring compliance with service-level agreements (SLA)

Passive reliance is a common audit finding.

Using Third-Party Data

When third-party data feeds CECL models, fair value calculations, or interest income reporting, auditors look for:

• Reconciliations between third-party data, internal records, and downstream model outputs
• Independent verification procedures
• Validation of key performance metrics

Summary reports alone are rarely sufficient.

Common Third-Party Control Gaps

Frequent issues include:

• Assuming SOC reports eliminate the need for internal controls
• Failure to implement complementary user entity controls
• No reconciliation between servicer trial balances and the general ledger
• Overreliance on summary reports without underlying detail
• Limited documentation of monitoring activities

These gaps often surface during growth, acquisitions, or system changes.

Why Data and Third-Party Controls Influence Valuation and Audit Outcomes

Loan portfolio valuations and audit conclusions depend on the integrity of the data flowing through origination, servicing, and reporting systems. While a point‑of‑sale (POS) system is typically covered by a SOC report, that coverage rarely extends to every downstream system used for aggregation, modeling, and financial reporting.

When data moves from a SOC‑covered system into intermediary platforms, data warehouses, or reporting tools, internal controls must be applied at each step. These intermediary environments often feed significant accounting estimates and disclosures, making them a frequent audit focus.

Common valuation risks include:

• Inaccurate delinquency or prepayment data skewing expected credit loss estimates
• Weak oversight of third-party servicers that increases the risk of misstatements
• Inconsistent data sources used across different reports or models
• CECL and fair value models that rely on data flowing through intermediaries with unknown control coverage

As specialty finance portfolios grow in size and complexity, investors and capital providers increasingly scrutinize how companies govern data and oversee third parties. Effective controls across both internal systems and outsourced providers support complete and accurate information, defensible valuations, smoother audits, and greater confidence in reported results.

Practical Next Steps for Specialty Finance Companies

To strengthen oversight and reduce audit friction, companies can:

• Conduct a data flow walkthrough from origination to financial reporting
• Identify and document key system interfaces
• Evaluate SOC report coverage and complementary controls
• Strengthen reconciliation processes between servicing systems and the general ledger
• Formalize documentation of management review controls

We Can Help

In high-volume specialty lending environments, data quality and third-party oversight are foundational to reliable financial reporting. Companies that invest in disciplined data governance and structured monitoring of outsourced activities reduce audit risk, improve transparency, and enhance investor confidence.

Elliott Davis supports specialty finance companies through:

• SOC reporting and service organization audits
• Internal control design, implementation, and assessment
• Financial statement audit and accounting advisory services
• Information technology general controls (ITGC) assessments

Contact us today to get started.