Quality Control (QA/QC) capability of the Loan Origination Solution, which automates document validation across pre-funding and post-closing stages, with its four-layer architecture and Simple and Preferred implementation approaches.

QA/QC (Quality Control) is a capability of the Loan Origination Solution that automates document validation across both pre-funding and post-closing stages of the origination process.

It classifies and extracts data from loan packages, applies institution-specific business rules, and performs cross-validation across documents, system-of-record data - for example, Loan Origination System or core - and external sources, surfacing exceptions for reviewer action to ensure complete, accurate, and compliant loan files.

QA/QC in lending is still heavily manual, with teams performing 'stare and compare' reviews across hundreds of pages, systems, and third-party documents to validate loan accuracy and compliance. This process is time-intensive, difficult to scale and inherently inconsistent, making it easy for errors, missing documentation, or data mismatches to slip through or be caught too late.

As volumes increase, costs rise with headcount, while institutions remain exposed to compliance risk, repurchase risk, and potential financial loss from preventable defects.

QA/QC is built on four layers: an orchestration layer, a UiPath component layer, a customization layer, and a data layer.

UiPath Maestro orchestrates the end-to-end workflow. Processing is triggered when the customer's dispatcher RPA calls the Maestro process's API endpoint with a loan record; your institution builds and maintains this dispatcher.

Maestro then invokes IXP for document classification and extraction, runs the QA/QC agent against the extracted data and business rules, and writes structured outputs to Data Fabric. The Maestro Loan Analysis workflow is built and distributed by UiPath and is not editable, but it is visible in your Orchestrator and Maestro monitoring views in cloud.uipath.com.

The processing pipeline relies on three main components:

Business rules are stored as a JSON document in an Orchestrator storage bucket and are configured with the institution during implementation. IXP models for document classification and extraction are also built and tested with the institution.

Loan records, document metadata, extracted field values, business rule findings, and reviewer activity are all stored in UiPath Data Fabric. Customer bank systems (core banking, LOS, and document repositories) provide the source data via RPA integrations. The QA/QC application reads and writes exclusively through Data Fabric.

QA/QC can be implemented in two ways, depending on the level of system integration required.

In the Simple implementation, reviewers upload documents manually through the Add Loan form in the application. No system integration is required. This approach is appropriate for pilots, low-volume environments, or institutions without a document management system accessible for automated retrieval.

In the Preferred implementation, loan documents are retrieved automatically from the institution's core banking system, loan origination system (LOS), and document management system using pre-built or custom RPA integrations. The Dispatcher triggers processing automatically when new loan records appear in the queue. This approach eliminates manual upload, reduces processing time, and supports high-volume production deployments.

When a loan record enters the queue, the system classifies every uploaded document against the institution's expected document checklist. Documents that match known types are extracted and processed; documents that cannot be matched are flagged as unclassified. If required document types are absent from the uploaded package, the loan is marked as having missing documents and a reviewer alert is generated.

After classification and extraction, the QA/QC agent evaluates each document against the applicable business rules. Rules may reference a single document (checking a value within the document) or cross-reference two documents (comparing a value in one document against a value in another). The agent returns a finding for each rule.

Reviewers then work through each document's checklist, confirm or dismiss findings, and track their decisions as Confirmed or Not an issue.

QA/QC uses three user groups with distinct roles and permission scopes.

Data Fabric permissions are managed inside Data Fabric independently of UiPath Authentication.

The solution also ships four entities that do not carry the FINS prefix: DecisionModels, Policies, Profiles, and Evaluations. Business users on granular permissions need the same access on these four, or the decision model and policy screens render empty.

The QA/QC application includes a shared role-based access control (RBAC) capability that gates access by UiPath Identity group membership. Access is controlled through the FINSRoleGroupMapping entity, which maps each UiPath Identity group to a role.

Access to the QA/QC application as a whole is gated on group membership: a signed-in user must belong to an Identity group named in FINSRoleGroupMapping, any of them, or the application shows an access-denied screen instead of the review screens. Specific routes, screens, and privileged backend operations are then gated more narrowly on top of that baseline.

Because the gate reads the mapping entity at runtime, a missing row or a mistyped group name is corrected in Data Fabric and takes effect on reload, with no redeployment.

The application gate governs what the application shows, and is not a data-access boundary. Data Fabric requests carry the signed-in user's own token, so the entity-level permissions described above remain what actually restricts access to data.

RBAC is configured with your institution during implementation: UiPath Identity groups are created, each group is mapped to a role, and the required frontend and backend prerequisites are met.

The QA/QC application signs users in to the web experience through a Non-Confidential external application. These scopes are used alongside Business User Group permissions. Granting the scopes to the external application alone does not enable business users.

Request a demo to connect with the UiPath team about the Loan Origination Solution.