5. Requirement Elicitation
5.1 Loan Officer Interview
5.1.1 Interview Objective
The objective was to understand:
- Current loan approval process
- Approval criteria
- Missing document handling
- Approval authority
- Rejection handling
- Notifications
- Reporting requirements
5.1.2 Interview Questions
Q1. Can you explain the current loan approval process from
the time a customer submits an application?
Finding
The customer provides personal, employment, income and
supporting information.
The application is registered and given a reference
number.
An initial completeness check is performed.
The application then moves through verification and credit
evaluation.
Based on the required authorization level, the application
is routed for approval.
The final outcome may be:
- Approved
- Rejected
- Additional Information Required
Q2. What documents are normally required?
Finding
Documents can include:
- Identification documents
- Passport where applicable
- Salary certificate
- Recent salary slips
- Bank statements
- Employment information
- Existing financial obligation information
The exact requirements may vary based on customer and
application characteristics.
Q3. What happens when documents are missing?
Finding
The application may be placed on hold.
The customer is contacted and asked to provide the missing
information/documents.
The current process generally allows approximately
7 calendar days for the customer to
provide the required information.
Once received, the information is reviewed again.
Q4. What factors are considered during credit evaluation?
Finding
Credit evaluation may consider:
- Income
- Employment information
- Existing financial obligations
- Credit history
- Requested loan amount
- Repayment capacity
- Customer risk profile
- Applicable lending policies
Exact thresholds and formulas require confirmation from
the relevant credit policy.
Q5. How is approval authority determined?
Finding
Approval authority depends on factors such as:
- Requested loan amount
- Customer risk profile
- Applicable authorization matrix
Applications requiring higher authority may be routed to
additional approval levels.
Q6. What happens if there are multiple approval levels?
Finding
The application is routed through the required
authorization levels.
The next approval stage proceeds after the previous
required approval.
If an authorized approver rejects the application, the
approval progression stops.
Q7. What happens when an application is rejected?
Finding
The rejection decision and reason are recorded.
The customer is notified according to the applicable
communication process.
Q8. What information should be recorded for an
approval/rejection?
Finding
The system should capture information such as:
- Decision
- Date/time
- Approver
- Reason
- Comments/remarks
- Relevant application history
Q9. What notifications are required?
Finding
Important customer events may include:
- Application submitted
- Additional information required
- Application approved
- Application rejected
- Status changes
The exact communication channel requires confirmation.
Q10. What reports are useful to management?
Finding
Potential reports include:
- Applications received
- Approved applications
- Rejected applications
- Pending applications
- Applications awaiting customer information
- Processing/turnaround time
- Rejection reasons
- Verification delays
5.2 Verification Officer Interview
5.2.1 Interview Objective
The objective was to understand:
- Document verification
- Customer information verification
- Verification systems
- External services
- Missing document handling
- Discrepancy handling
- Verification outcomes
- Handover to Credit
5.2.2 Interview Questions and Findings
Q1. Can you walk me through the current verification
process?
Finding
After the application passes the initial completeness
stage, it enters the verification queue.
The Verification Officer reviews:
- Personal information
- Employment information
- Financial information
- Submitted documents
The officer checks whether the information is complete,
readable and consistent.
Internal systems and, where required, approved external
services may be used for verification.
The verification result and relevant comments are
recorded.
Q2. What do you check when validating documents?
Finding
Documents are checked for factors such as:
- Relevance
- Validity
- Expiry
- Legibility
- Consistency with application information
- Acceptable source
Some information may require additional verification.
Q3. What systems are currently used?
Finding
The process may involve:
- Loan/application system
- Customer information systems
- Document management systems
- Internal verification tools
- External verification services
Not all systems are necessarily integrated.
This can result in manual retrieval and recording of
information.
Q4. What happens when documents are missing?
Finding
The application remains on hold.
The customer is asked to provide the missing documents.
The current process generally allows approximately 7
calendar days.
Once the documents are received, the Verification Officer
reviews them again.
Q5. What happens when the customer does not provide the
documents?
Finding
The application remains pending during the permitted
period.
If the required information is not received within the
applicable period, the application may be closed/rejected
according to policy.
The status and reason should be recorded.
Q6. What happens when there is a discrepancy?
Finding
The Verification Officer investigates the discrepancy.
The customer may be asked for:
- Clarification
- Additional documentation
- Corrected information
The application remains pending until the discrepancy is
resolved or the applicable policy requires another
outcome.
Q7. What verification outcomes are possible?
Finding
Possible outcomes include:
- Verified
- Additional Information Required
- Unable to Verify / Verification Failed
The outcome and relevant comments should be recorded.
Q8. What happens after successful verification?
Finding
The application is handed over electronically to the
Credit Officer.
Relevant information includes:
- Customer information
- Application information
- Submitted documents
- Verification result
- Relevant comments
5.3 Credit Officer Interview
5.3.1 Interview Objective
The objective of the Credit Officer interview was to
understand:
- Credit evaluation
- Eligibility criteria
- Financial information
- Credit history
- Risk assessment
- Existing obligations
- Decision inputs
- Exceptions and escalation
5.3.2 Credit Officer Interview Questions and Findings
Q1. What information do you need to evaluate a personal
loan application?
Finding
The Credit Officer requires information such as:
- Customer personal information
- Employment information
- Income
- Existing financial obligations
- Credit history
- Requested loan amount
- Verification outcome
- Relevant customer risk information
Q2. What are the main factors considered when determining
eligibility?
Finding
The credit evaluation considers factors such as:
- Income
- Employment status/type
- Existing financial obligations
- Credit history
- Requested loan amount
- Repayment capacity
- Customer risk profile
- Applicable lending policies
Exact thresholds and calculations should be obtained from
the bank’s approved credit policy.
Q3. How is repayment capacity assessed?
Finding
Repayment capacity is assessed using financial information
such as income and existing obligations together with
applicable lending criteria.
The exact calculation or ratio should be documented only
after confirmation from the approved credit policy.
Q4. How is credit history obtained?
Finding
Credit information may be obtained through an approved
credit information source/service.
The system may need to capture or display relevant credit
information required for the decision.
The exact source, data fields and integration method
require confirmation.
Q5. What happens if the credit information cannot be
obtained?
Finding
The application may require further investigation or
additional information.
The exact handling depends on the applicable bank policy
and credit process.
This should therefore be treated as an open requirement
until confirmed.
Q6. What happens if the customer’s financial information
does not meet eligibility criteria?
Finding
The application may be rejected or handled according to
the applicable lending policy.
The decision and reason should be recorded.
Q7. Can a Credit Officer override an eligibility result?
Finding
Any exception or override should be controlled according
to the bank’s authorization and credit policy.
If overrides are permitted, the system should capture:
- Authorized user
- Reason
- Date/time
- Decision
- Supporting comments/evidence where required
Q8. What information should the Credit Officer see on the
application screen?
Finding
The Credit Officer should have access to relevant
information such as:
- Customer details
- Employment information
- Income
- Existing obligations
- Requested loan amount
- Credit information
- Verification outcome
- Supporting documents
- Relevant application history
Access should be based on role and authorization.
Q9. What happens after the credit evaluation?
Finding
The application proceeds to the next stage based on the
applicable business process.
It may move to the Loan Officer/approval stage or require
additional information depending on the evaluation result.
Q10. What should happen when the Credit Officer identifies
inconsistent information?
Finding
The application may require clarification or additional
information.
The issue should be recorded and the application should
remain in an appropriate pending state until resolved.
5.3.3 Credit Officer Findings Summary
| ID |
Finding |
| CO-F01 |
Credit evaluation requires customer and financial
information
|
| CO-F02 |
Income is an important credit evaluation input
|
| CO-F03 |
Employment information is considered |
| CO-F04 |
Existing financial obligations are considered
|
| CO-F05 |
Credit history is considered |
| CO-F06 |
Requested loan amount is considered |
| CO-F07 |
Customer risk profile may affect decision |
| CO-F08 |
Verification outcome is required before/for credit
evaluation
|
| CO-F09 |
Exceptions/overrides must follow authorization
policy
|
| CO-F10 |
Credit decision information should be recorded
|
| CO-F11 |
Inconsistent information may require clarification
|
| CO-F12 |
Exact eligibility thresholds require validation
against approved credit policy
|
5.4 Compliance Officer Interview
5.4.1 Interview Objective
The objective was to identify:
- Regulatory requirements
- KYC-related requirements
- Audit requirements
- Data retention
- Record keeping
- Customer consent
- Compliance controls
- Regulatory reporting considerations
5.4.2 Compliance Officer Interview Questions and Findings
Q1. What compliance requirements must the loan application
process follow?
Finding
The system must support applicable banking, customer
identification, data protection, lending, audit and
record-keeping requirements.
The exact regulatory requirements depend on the bank’s
jurisdiction, products and internal compliance policies.
Q2. What customer information must be captured for
compliance purposes?
Finding
The system should capture the customer information
required by applicable regulatory and internal policies.
Potential categories include:
- Customer identification information
- Contact information
- Employment information
- Financial information
- Required supporting documents
- Relevant declarations/consents
The final data list must be confirmed by Compliance.
Q3. Are customer documents required to be retained?
Finding
Required records should be retained according to
applicable regulatory and organizational retention
policies.
The system should therefore support controlled document
storage and retention.
The exact retention period is an open question until
confirmed.
Q4. Should the system maintain an audit trail?
Finding
Yes.
Important activities should be traceable.
Potential audit information includes:
- User
- Action
- Date/time
- Application/reference
- Previous value where applicable
- New value where applicable
- Decision
- Reason/comments
Q5. Which actions should be audited?
Finding
Examples include:
- Application creation
- Document upload
- Document replacement
- Verification outcome
- Additional information request
- Credit evaluation
- Approval
- Rejection
- Status changes
- Changes to customer/application information
- Authorization/override actions
The final audit scope should be validated with Compliance
and Security.
Q6. Are customer consent or declarations required?
Finding
Where required by applicable policy or regulation, the
system should capture customer consent/declarations and
retain evidence of the action.
Exact wording and consent requirements must be provided by
Compliance/Legal.
Q7. Are there restrictions on who can access customer
information?
Finding
Yes.
Access should be restricted according to role,
responsibility and authorization.
Users should only access information required for their
job responsibilities.
Q8. What happens if a compliance requirement is not
satisfied?
Finding
The application should not progress to a stage that
requires the missing compliance control until the issue is
resolved or an authorized exception process is followed.
The exact handling must be defined by the applicable
policy.
Q9. Are there compliance reports required?
Finding
Potential reports may include:
- Applications by status
- Exceptions
- Audit activity
- Verification issues
- Approval/rejection information
- Compliance-related events
The mandatory report list requires confirmation.
Q10. Are there any restrictions on modifying records?
Finding
Important records should not be silently overwritten.
Changes to controlled information should be traceable
through the audit history.
5.4.3 Compliance Findings Summary
| ID |
Finding |
| CMP-F01 |
The application must support applicable regulatory
requirements
|
| CMP-F02 |
Required customer identification/information must
be captured
|
| CMP-F03 |
Required documents/records must be retained
according to policy
|
| CMP-F04 |
Important application activities require
auditability
|
| CMP-F05 |
Customer consent/declarations may need to be
captured
|
| CMP-F06 |
Access to customer information must be controlled
|
| CMP-F07 |
Compliance exceptions require controlled handling
|
| CMP-F08 |
Controlled records should maintain change history
|
| CMP-F09 |
Compliance reporting may be required |
| CMP-F10 |
Exact regulatory rules and retention periods
require validation
|
5.5 Security Team Interview
5.5.1 Interview Objective
The objective was to understand:
- Authentication
- Authorization
- Role-based access
- Customer data protection
- Document security
- Audit logging
- Session management
- Security monitoring
- Integration security
5.5.2 Security Interview Questions and Findings
Q1. How should users authenticate into the system?
Finding
The system should use the bank-approved authentication
mechanism.
Customers and employees may require different
authentication approaches.
The exact authentication mechanism should be confirmed
with the Security/Architecture teams.
Q2. Should customers and employees have different access?
Finding
Yes.
Customer and employee functions should be separated.
Employees should receive access based on their role.
Q3. Should all employees be able to view all loan
applications?
Finding
No.
Access should follow the user’s role and authorization.
For example:
-
Verification Officer → verification-related information
- Credit Officer → credit evaluation information
- Loan Officer → approval-related information
- Compliance → compliance/audit information
-
Security → security/audit information as authorized
Exact access permissions require a detailed
role-permission matrix.
Q4. How should customer documents be protected?
Finding
Customer documents contain sensitive information and
should be protected through appropriate security controls.
Controls may include:
- Authorized access
- Secure storage
- Secure transmission
- Monitoring
- Controlled download/access
The exact technical implementation is an
architecture/security decision.
Q5. What activities should be logged?
Finding
Security-relevant activities should be logged.
Examples include:
- Login attempts
- Authentication events
- Access to sensitive information
- Document access
- Permission changes
- Administrative actions
- Important application actions
Q6. What should happen after repeated failed login
attempts?
Finding
The system should follow the bank’s approved
authentication/security policy.
Possible controls may include account lockout, additional
verification or other security measures.
The exact policy must be confirmed.
Q7. How should sessions be handled?
Finding
Session timeout and session security should follow
approved security standards.
The exact timeout duration requires confirmation.
Q8. How should APIs and external services be secured?
Finding
System-to-system communication should use approved secure
integration mechanisms.
Authentication, authorization, encryption and monitoring
should follow the bank’s integration security standards
Q9. Should sensitive data be masked?
Finding
Sensitive information should be displayed only when
necessary and according to security/privacy requirements.
Certain fields may require masking based on policy.
Q10. Should security incidents be traceable?
Finding
Security-relevant events should be logged and monitored
according to the organization’s security monitoring
process.
5.5.3 Security Findings Summary
| ID |
Finding |
| SEC-F01 |
Bank-approved authentication must be used |
| SEC-F02 |
Customer and employee access should be separated
|
| SEC-F03 |
Employee access should follow role-based
authorization
|
| SEC-F04 |
Customer documents require appropriate protection
|
| SEC-F05 |
Security-relevant activities should be logged
|
| SEC-F06 |
Sensitive information should be protected from
unauthorized access
|
| SEC-F07 |
Authentication/session controls must follow
security policy
|
| SEC-F08 |
External integrations require secure communication
|
| SEC-F09 |
Sensitive fields may require masking |
| SEC-F10 |
Security events should be traceable and
monitorable
|
