This piece in Bobsguide is a touch self-serving (it was inserted by Algorithmics), but it makes a valid point.

Much of the press coverage concerning the ‘subprime meltdown’ has focused on the products themselves and the credit risk involved. They have variously been characterized as too risky, unsuitable or designed to appeal to unsophisticated buyers by offering cheap teaser interest rates.
However many of the subprime mortgage product cases appearing in Algorithmics’ FIRST database of loss events involve an element of insufficient operational risk processes; primary among these processes is lax underwriting, which often involves insufficient background checks, inadequate documentation and a failure to train and supervise front-line personnel. Eighty three per cent of the cases can be attributed to relationship risk, including mis-selling, suitability issues, contract obligations and regulatory and compliance violations.

Much of the bad lending that gets done is not simply lending that goes bad after being written – they are loans that probably should not have been written in the first place. If the loan is written in contravention of established procedures, or was written due to fraud, that is not a credit risk loss but an operational risk loss. The difference is crucial when it comes to finding a solution.

Credit risk can properly be regarded as something that happens as part of the business of writing loans – some of them will go bad. If too many go bad, then you need to update your policies and procedures and maybe find some additional capital. If loans are being written in contravention of policies and procedures, however, then a different solution is needed. This may include retraining, counselling, targeted redundancies (i.e. sackings) and probably some management changes.

If you identify the problem incorrectly, the proposed solution will

also be wrong.