Exceptions should be in policy, and universally applied (not if a customer asks for it - some customers may be bad at negotiating. Also, if the exceptions were predominantly given to non-minority borrowers, regulators could insinuate that they were being offered by the loan officers selectively.)
I generally recommend creating exception codes, for both approvals and pricing. This will provide management with valuable analysis tools – being able to identify the number and types of exceptions, and monitor the portfolio to see if the exceptions were ultimately advantageous or a detriment. These exceptions should also be recorded and tracked by the departments, analyzed and reported to the Board by management. This unique identification of loans with exceptions simplifies retrieving for monitoring purposes, analysis and reporting.
Tracking and managing exceptions can also identify those areas where policies may need to be revisited. If a substantial portion of loans have similar exceptions, management may wish to validate the necessity of the policy, term or procedure. In a credit scoring system, revalidation is one of its most important controls. Similarly, revalidating a policy or procedure where exceptions were used to override the policy would give management a better perspective of how the policy fits into the overall goals of the bank.
Integrity. With it, nothing else matters. Without it, nothing else matters.