CR 3 – Credit Risk Management

Credit risk, also called counterparty risk, is the possibility that a borrower or the issuer of a financial instrument fails to pay principal, interest or other contractual cash flows on the terms it agreed. The counterparty may be a person, a company or a sovereign. When payments arrive late or never arrive, the bank faces a hole in its expected cash flows, and that hole quickly becomes a liquidity problem as well as a loss.

The reason this risk dominates banking is simple arithmetic. Even after decades of financial innovation, more than 70 percent of a typical bank’s balance sheet is tied to credit exposure, mostly loans. So, when banks fail, bad credit is far more often the root cause than anything else, and managing it well decides whether most banks survive. The tests used to judge a borrower’s creditworthiness apply equally to any counterparty whose securities the bank holds, so the loan-focused discussion below covers investment and financing assets in general.

Who sets credit policy and what it should do

Analysts and supervisors both look hard at the formal credit policies that a bank’s board approves and management carries out. A lending or financing policy fixes the scope of the bank’s credit facilities, how credit is allocated, and how the portfolio is run across its life, from origination and appraisal through supervision to final collection.

A good policy is firm without being rigid. Officers should still be able to put a proposal to the board when they think it deserves attention even though it sits outside the written rules, so the bank can react fast when its asset mix or its market shifts. Regulators almost everywhere set minimum standards here: banks must identify existing and potential risks, write down policies that express their risk philosophy, and set the boundaries within which credit risk is kept.

The three families of credit risk policy

The lesson follows that order. Behind it sit a few broad points: capping loans to insiders and to big related borrowers cuts risk directly; classification and provisioning change the true value of both the loan book and capital; and the bank must be clear about whom it lends to, what it lends and for how long, since the length of its loans interacts with liquidity risk. The quality of the bank’s people, processes and information then largely decides how good its practice turns out to be.

Regulators trying to contain credit risk focus on three things: how much a bank lends to one customer, how much it lends to parties related to the bank, and how heavily it leans on one region or one economic sector. This section covers the first.

A large exposure or concentration limit caps what a bank may have outstanding to a single client, to a connected group of clients, or to one sector such as agriculture, steel or textiles. Such limits matter most for small, regional and specialised banks, whose books are naturally less diversified, and the lending policy should require every concentration to be reviewed and reported often.

How the limit is set

Prudential rules usually stop a bank from lending to, or investing in, one entity or one related group beyond a fixed share of its capital and reserves. In most countries that single-customer ceiling falls in the range of 10 to 25 percent of capital. Supervisors add a reporting threshold below the hard ceiling. Once an exposure crosses that lower line the bank must report it, so the supervisor can watch it and push for precautions before the concentration turns truly dangerous.

What counts as exposure

The hard part is deciding how much indirect credit risk to count. In principle every contingent liability and credit substitute belongs inside the limit: guarantees, acceptances, letters of credit and all future commitments. Treatment can still vary by instrument; a guarantee of a financial obligation may be weighted differently from a guarantee of contract performance. Collateral is the other contested point. Because its value rests on judgment, prudence says it should be ignored when exposure is measured, so a fully collateralised loan still counts in full.

Who is a single client

International practice treats a single client as a person, a company, or a connected group to which the bank has exposure. A connected group is a set of clients that are linked to, or control, one another directly or indirectly, usually through a voting stake of at least 15 to 20 percent, a dominant holding, or the power to steer policy and management. Clients without formal links can still form one cumulative risk when they are financially interdependent and expect to repay from the same source. A chart of the twenty largest borrowers often makes the danger plain: they can account for more than half of gross loans and, more alarmingly, several times the bank’s qualifying capital, which is why limits are measured against capital.

Why large exposures need special handling

A large exposure usually signals that the bank has committed itself to supporting a particular client, and that commitment can erode its objectivity in judging the client’s risk. Managing large exposures also tests whether the bank can spot common ownership, exercise real control and rely on shared cash flows to meet its own obligations. Information on big debtors must be complete. Credit officers should track events that affect large clients continuously, even while those clients pay on time, ask for more information when outside events cause concern, and escalate any sign of repayment trouble to senior credit management along with a contingency plan.

Lending to related or connected parties is one of the most dangerous forms of credit exposure. Related parties normally include the bank’s parent, its major shareholders, subsidiaries and affiliates, its directors and its executive officers. These are exactly the people and entities able to sway the bank’s decisions, including who gets credit. So, a bank must be able to identify every extension of credit to insiders and follow it over time.

Two questions drive the review. The first is whether each decision was rational and followed the bank’s own policies and procedures. The second is whether the insider got market terms, or instead a larger amount, a longer maturity, a lower rate or lighter collateral than an ordinary customer would receive.

Limits and approval

Most regulators cap total credit to related parties at a percentage of Tier 1 capital or of total qualifying capital. Where the rules set no such cap, the board should impose one as policy. Sound practice also has the board itself approve every facility granted to a related party, which takes the decision away from the officers most exposed to pressure.

A monitoring template

A practical monitoring sheet lists each class of related party in rows and records, for each, the amount of loans, the amount of weak loans, both as a share of qualifying capital, and the collateral held. The rows run from shareholders with more than 5 percent of the shares and those with less, through shareholders of shareholders, the board and executive management, to entities the bank controls, entities that control the bank, and close relatives of any of these, closing with a total.

A bank’s own lending policy sets out the scope and allocation of its credit facilities and how the portfolio is run. As with regulation, it should leave room for officers to bring a worthwhile loan to the board even if it falls outside the guidelines, so the bank can respond quickly when its earning assets or its market shift.

Large banks often describe their practice as a cycle. The version used by South Africa’s FirstRand Bank runs through six stages.

Lending authority

Who may approve a loan depends mainly on size. Small banks usually keep authority at the centre, while large banks spread it by region, product and customer type to avoid delays. Either way, every lending officer needs a limit. Where policies are clear and enforced, an experienced officer with long service may be given a somewhat higher limit than usual. A committee can also hold group authority for larger loans, and the policy should say how it reports and how often it meets.

Types of loan and their distribution

The policy should name the credit instruments the bank will offer and give guidance on each. That choice should rest on the skills of the lending staff, the bank’s deposit base and the demand it expects. Credit types that have caused unusual losses should be placed under senior management control or dropped. Caps on broad categories, such as commercial, real estate or consumer lending as a percentage of total loans, are common, with board-approved exceptions.

Appraisal process

The policy should say who owns appraisals and lay down standard procedures, including reappraisal on renewal or extension. It should set acceptable appraisal types and limits per facility, say when an independent qualified appraiser is needed, and specify the loan-to-value ratio against both project and collateral, the valuation method, and any down payment schedule.

Loan pricing

The rate on each type of loan has to recover the cost of funds, the cost of supervising and administering the loan (overhead included) and expected losses, and still leave a reasonable profit. Rates should be reviewed as costs and competition move. A bank may keep deliberate rate differentials, either to steer some borrowers elsewhere or to attract a type it wants. Commitment fees and penalty interest belong to the same pricing policy.

Maturities

Each type of credit should carry a maximum maturity, and each loan a repayment schedule the borrower can realistically meet. The schedule should match where the repayment cash is expected to come from, what the money is for, and how long the pledged asset will last, so a loan is not still running after the asset securing it has worn out.

Concentration is not only about single names. A bank that lends heavily to one industry or one narrow region can see several clients fail at once for the same reason. This matters most for regional and specialised banks and for banks in small economies with a narrow base, such as those that rely on farming or on exporting one commodity. A sector breakdown of loans, compared with a prior period, shows how exposure to agriculture, manufacturing, construction, transport, trade, tourism, services, individuals and other sectors is moving.

Measuring sector exposure is often harder than it sounds, because many reporting systems do not capture it. A holding company of a large, diversified group may borrow once and then fund projects in several of the group’s industries, so the bank records one borrower while the risk sits in many sectors. Banks need systems that track sector risk, estimate how adverse trends would hit portfolio quality and income, and respond as the risk grows.

Country risk and transfer risk

Cross-border lenders carry two extra risks. Country risk, also called sovereign risk, covers every macroeconomic, political and social condition in a country that can hurt borrowers there. Transfer risk is narrower: a borrower, however sound, may be unable to get hold of the foreign currency it needs to pay the bank. Classification of international loans should normally reflect both. A bank may be asked to provision loan by loan, raising each provision for the extra risk, or to total its country and transfer exposure country by country and hold special reserves against each total.

Insisting on current financial information

Safe lending depends on full and accurate information about the borrower’s credit standing. The common exception is a loan approved against readily marketable collateral that is itself meant to repay it. Otherwise, the policy should set the financial statements required at each borrowing level, covering audited, unaudited, interim and cash flow statements, plus external credit checks when information is refreshed. For loans longer than one year, officers should project the borrower’s finances over the whole loan term to confirm cash flow can repay it, with written assumptions. The requirements should be precise enough that negative credit data plainly signals a policy breach.

Collections monitoring

The policy should define delinquency for every credit type and the reports that go to the board, with enough detail to judge the risk, the potential loss and the options available. Collection follow-up should be systematic and escalate step by step, and every major problem loan should reach the board for review.

Limits on total loans and on lending against securities

A ceiling on the whole loan book is normally stated against deposits, capital or total assets, and setting it needs a view on credit demand, deposit volatility and credit risk. Where securities are pledged, the policy should cap the loan as a ratio of their market value, with margins linked to how easily each security can be sold, and should name who reprices the collateral and how often.

A loan is impaired when the bank will probably not collect what the loan agreement says it is owed. Policy should make the bank find and recognise impairment systematically, for single loans and for groups assessed together. Recognition works in one of two ways: the loan’s carrying amount is written down to its estimated realisable value through an existing allowance, or the loss is charged to the income statement in the period the impairment arises.

What counts as renegotiated debt

Renegotiated debt is a loan restructured to cut interest or principal payments because the borrower’s finances have deteriorated. The key word is concession: a loan extended or renewed on the terms the bank would give new debt of similar risk is not renegotiated debt. A restructuring might see the borrower hand over property, receivables or other third-party assets, swap part or all of the debt for equity, or bring in a new debtor alongside the original one.

Good practice is for the board to approve such deals before any concession is granted, and for policy to make sure they are booked and controlled properly. The restructured loan is measured by cutting the recorded investment to net realisable value after the cost of every concession at the restructuring date, and that cut is charged to income in the same period.

Plenty of renegotiated debt usually means the bank is in trouble. The sensible exception is a period of falling interest rates, when both debtor and creditor may gain from rewriting the original terms.

Written internal guidelines

The lending policy should be backed by written guidelines for each department that handles credit, and those approved departmental procedures should be referenced in it. Missing written policies and procedures are a serious weakness in themselves and suggest the board is falling short of its fiduciary duty.

A loan book mirrors the bank: its market position, the demand it faces, its strategy and its ability to lend all show up in what it has lent. A review needs coverage rules that make the sample meaningful.

Coverage of the sample

Where feasible, the random sample should reach roughly 70 percent of total loan value while including 30 percent of the loan count. For foreign currency loans, and for loans running beyond one year, coverage rises to at least 75 percent of value and 50 percent of count. Some loans are reviewed whatever the sample:

For each selected loan the reviewer reads the borrower’s file and discusses the business, its outlook and its credit record with the responsible officer. Where the amount owed exceeds 5 percent of capital, the review also weighs the borrower’s future plans and what they mean for debt service and repayment.

The summary file for each reviewed loan records who the borrower is and what it does, what the money is for, the grant date, maturity, amount, currency and rate, the main repayment source, the collateral and its value, the borrower’s total obligations to the bank (including contingent ones where the bank bears the risk), any arrears, the monitoring done, current financial statements, and the specific provisions needed and held.

Judging the overall allowance for losses

Asset values should be assessed systematically, consistently over time, against objective criteria and with documentation. Loss estimates always involve judgment, but that judgment must stay inside established policy. IFRS 9 now demands a forward-looking approach to loss estimates and provisions. Jurisdictions that still use fixed, rule-based provisioning, often alongside state-owned banks that avoid facing up to asset quality, must either comply with the Basel Accords and IFRS or lose credibility with international counterparts, the International Monetary Fund and the World Bank. Where the authorities will not adapt, an analyst is badly placed, since the published accounts cannot be trusted for decisions.

A review of the overall allowance covers five things: the provisioning policy and method, especially the value placed on collateral and whether it can be enforced legally and in practice; the classification procedures and the time given to review; current factors that may cause losses unlike past experience, such as changes in the economy, in clients, in outside conditions or in bank procedures since the last review; a longer-term trend analysis of overdue loans and their effect; and an opinion on the policy’s adequacy, with an extrapolation from the reviewed loans of the extra provisions needed to bring the total in line with IFRS.

After loans, money placed with other banks is the largest class of assets carrying credit risk. It can be a big part of the balance sheet, especially where the currency is not convertible but residents may hold foreign currency deposits. Banks also place funds with each other to move money, to settle securities trades, or because a larger or better-placed bank can provide some services more cheaply.

A review of interbank lending checks whether counterparty limits exist and are kept, whether any placement needs a specific provision, how nostro and vostro accounts are reconciled and how accurately, whether any placement is priced away from the market, and how concentrated the exposure is, with a list of banks, balances and limits. The rule is that an interbank deposit is a credit exposure like any other. Correspondent banks should be vetted for limits and for their ability to post collateral, and banks from strict, well-supervised systems that follow international standards usually count as lower risk than those from developing economies.

Off-balance-sheet commitments

Every off-balance-sheet commitment that creates credit exposure, such as a guarantee, should be reviewed on the same principles as a loan review. The reviewer judges how well the bank analyses, supervises and administers these instruments, and the central question for each item is whether the client can meet that commitment on time.

Overdue interest: suspension and nonaccrual

Uncollected interest can inflate income and hide nonperforming assets, so policy must say how it is treated. There are two basic methods.

Under suspension, the unpaid interest is still accrued or capitalised, but an equal entry is booked to an account called interest in suspense. For reporting, the two must be netted; otherwise assets are overstated.

Under nonaccrual, the bank reverses uncollected interest out of income and the balance sheet once the loan is placed in nonaccrual status. Interest accrued in the current period comes straight off current interest income. Interest from earlier periods is charged to the reserve for possible loan losses, or expensed against current earnings if no provision for accrued interest exists. The loan usually returns to accruing status once arrears of principal and interest are paid, or once future payments look secure.

Some jurisdictions let a bank hold off on interest arrears if the debt is well secured or in the process of collection. Well secured means backed by liens or pledges on real or personal property, securities included, worth enough on realisation to settle the debt in full, or guaranteed by a creditworthy party. In the process of collection means legal action or collection efforts are moving ahead and are expected to bring repayment or restore the loan to current status.

Asset classification gives each asset a credit grade based on how likely the borrower is to service and repay it on the contract’s terms. A review sets or confirms that grade, asking whether the credit will be repaid and whether the bank’s proposed grade is adequate, while weighing collateral quality and the borrower’s capacity to generate cash. Every asset on which the bank takes credit risk should be graded, from advances and receivables to investments, equity stakes and contingent liabilities.

Grading starts at origination, and assets are then re-graded as their risk changes, a few times a year. The review weighs loan servicing, the client’s finances, economic trends and movements in the markets and prices of the goods the borrower trades. Pass and watch assets are usually reviewed twice a year, and critical ones at least quarterly.

The five traditional categories

Banks grade assets themselves but follow standards that regulators usually set. The traditional scheme has five grades reflecting the chance of timely debt service. IFRS 9 is bringing in more complex expected loss methods, so this scheme is expected to fade in importance.

Standard or pass. Debt service capacity is not in question. Assets fully backed, principal and interest included, by cash or near-cash such as bank certificates of deposit and treasury bills and notes are normally graded standard even when they are in arrears.

Specially mentioned or watch. The asset has potential weaknesses that, left alone, could weaken it or threaten future repayment. Examples are credit granted under a weak loan agreement, without control over collateral or with poor documentation; loans to borrowers whose markets may hurt them later; and borrowers with worsening operations or an unbalanced balance sheet whose repayment is not yet threatened.

Substandard. Clear weaknesses now threaten debt service, typically because primary repayment sources fall short and the bank must look to secondary ones: collateral, sale of a fixed asset, refinancing or new capital. Typical cases are term loans to borrowers whose cash flow may not meet maturing debt, advances to badly undercapitalised firms, and short-term loans where the inventory-to-cash cycle cannot repay on time. Nonperforming assets at least 90 days overdue are normally substandard, as are renegotiated loans whose overdue interest the borrower paid from its own funds before renegotiation, until it performs reliably under a realistic plan.

Doubtful. The asset has the weaknesses of a substandard one, and on present facts full collection is questionable. Loss is possible, but factors that may yet strengthen the asset justify waiting before calling it a loss. Nonperforming assets at least 180 days past due are also doubtful unless sufficiently secured.

Loss. The asset is regarded as uncollectible and worth too little to keep as a bankable asset. Recovery is not ruled out; it is simply neither practical nor desirable to delay the write-off, even if some money comes back later. Nonperforming assets at least one year past due are also loss unless very well secured.

Rules that sit around the categories

The main weight falls on the client’s ability and willingness to pay from future operating cash flow. Some jurisdictions require all credit to one client to share one grade, with any difference explained; others judge each asset separately. Where subjective and objective tests disagree, the harsher grade should normally apply, and if the supervisor or external auditor grades more severely than the bank, the bank is expected to adopt that grade. Some advanced systems split the pass grade into several levels to separate credits better and to see how profitability varies with rating.

Nonperforming loans

A nonperforming asset is one that earns nothing. As a first screen, a loan is often called nonperforming once principal or interest has been due and unpaid for a set period, often 90 days or more, though this varies by jurisdiction. Grading and provisioning go well beyond counting late days; the borrower’s cash flow and overall capacity to repay matter far more. Set against the nonperforming book, total provisions show how much credit risk the bank can really absorb.

An analysis of nonperforming loans should age past-due principal and interest into buckets of more than 30, 90, 180 and 360 days, split by customer type and sector, to reveal trends and whether all customers are equally affected. It should find why quality has worsened, which points to possible remedies. It should take each problem loan individually to judge whether it can be turned around, what would restore repayment and whether workout or collection plans have been tried. It should also compare provisions with likely defaults and trace the hit to profit and loss.

Classification is the basis for deciding how much to set aside for possible loan losses. Those provisions, plus general loss reserves that are not tied to particular assets and normally count as Tier 2 capital, determine how much loss the bank can absorb. An adequate reserve weighs every significant factor in collectability: the quality of credit policies and procedures, past losses, loan growth, the quality of lending management, collection and recovery practice, shifts in national and local business conditions, and broad economic trends.

The expected loss formula

Expected loss answers three questions about each exposure. Whom has the bank lent to? That is borrower risk, captured by the probability of default. What product has it lent? That is facility risk, captured by loss given default. How long has the loan been running? That shapes exposure at default, since a client who has been repaying owes less, while an undrawn line may be drawn further before default. Inputs such as the risk rating, the counterparty type and any guarantees feed the estimates.

Probability of default (PD) is the chance, in percent, that an obligor misses full and timely payment within a given horizon. It is estimated per client, or per pool of similar clients, from the past behaviour of comparable borrowers. Sources include historical default databases, the deterioration seen in prices of credit default swaps, bonds and equity options, rating agency default histories, and credit scorecards.

Loss given default (LGD) is the percentage of the exposure expected to be lost if default happens, estimated from recoveries on similar past defaults.

Exposure at default (EAD) is an estimate, in the reporting currency, of what the counterparty would owe the bank at the moment of default, allowing for credit lines that are only partly drawn today.

Expected loss (EL) is the amount, in the reporting currency, the bank expects to lose on a counterparty, and it is the basis for the book provisions.

Unexpected loss (UL) is the loss in a high-stress scenario, usually read at a point far in the tail of the credit loss distribution, for example the 99th percentile. Pricing and provisions should cover expected loss as a cost of doing business; the further amount up to the tail point is what capital must absorb.

Applying the formula to three portfolios

The table applies the formula to three portfolios, each with a loan amount of 100,000. The columns are rearranged to follow the calculation and the totals row is added.

Loan amounts, ratings, PD, EAD, LGD and EL as printed in the source; the totals row is derived.

For financial years beginning on or after January 1, 2018, IFRS 9 brought accounting much closer to sound credit risk management. It replaced the incurred loss model of IAS 39, under which a loss was booked only once there was evidence it had happened, with an expected loss model that provides for losses before they arrive.

IFRS 9 sorts assets into three stages, and the stage fixes both the horizon of the loss allowance and the base on which interest income is measured.

Stage 2 deserves a closer look because judgment, not default, triggers it. An asset moves there when it falls into arrears or when the credit environment shifts enough that the bank, underwriting the same client today, would have set a materially different price or terms. Higher interest rates that weaken a client’s debt service capacity are the standard illustration. At that point the allowance jumps from twelve months of expected loss to expected loss over the asset’s whole remaining life, even if the client is still paying.

Banks handle loss assets in one of two ways. Under the first, loss assets stay on the books until every route to collection has been tried. This is common in systems built on the British tradition, and it makes the loss reserve look unusually large, because the reserve stands against assets that are effectively dead but still recorded. Under the second, loss assets are promptly written off against the reserve and leave the books. This is the U.S. tradition and the more conservative one: the assets are treated as nonbankable, though not necessarily unrecoverable, and because they leave at once the reserve looks smaller relative to the remaining loans.

An analyst judging provisions must therefore know whether the bank writes losses off aggressively or merely provides for them. Which approach a country uses often turns on how the tax authorities treat provisions.

Assessing the workout function

If problem loans are not tackled in time, chances to shore them up or collect slip away and losses can grow until they threaten solvency. An assessment looks at how the function is organised and staffed, how the workout units perform judged by attempted and successful recoveries in number and value and by average recovery time, the methods used, and how involved senior management is.

Each loan and borrower in workout is treated on its own merits, and the usual strategies fall into four groups.

The make-up of a bank’s assets reveals its business profile, its priorities and the intermediation risk it is prepared to carry. Any credit risk analysis should therefore establish which products the bank has lent, who received them, and over what term.

An aggregate portfolio analysis summarises the main loan types with customer numbers, average maturity and average rate earned. It shows the book from several angles, by count and by value: currency, maturity under or over one year, industry, state-owned versus private borrowers, and corporate versus retail. It lists loans with government or other guarantees, reviews loans by grade, and analyses nonperforming loans with attention to loss experience per vintage. Vintage analysis measures losses on loans granted in each period, which shows whether credit discipline is holding or slipping.

The three profiles are linked. If a bank’s customers move from state enterprises to private firms and households, its products shift too, perhaps toward mortgages and installment credit, which tend to run longer. So, a change in whom the bank lends to shows up in what it lends and for how long, and longer maturities feed straight into liquidity risk management.

A board acts for both depositors and shareholders, so it must make sure lending meets three aims: loans are sound and collectable, funds earn a profit for shareholders while depositors stay protected, and the legitimate credit needs of firms and households are served.

A risk management capacity review asks whether the lending process is well organised with policies written into procedures and manuals, whether staff are adequate and diligent in following policy, and whether the information reaching people in the lending process is timely, accurate and complete.

Lending process

Credible lending rests on objective decisions that keep risk acceptable relative to expected return. The review examines the credit manuals and guidelines used across departments and the capacity and performance of each department with a credit role, across origination, appraisal, approval, disbursement, monitoring, collection and handling. It samples application forms, credit summaries, manuals and files; checks approval criteria, pricing policy, lending limits at each management level and branch lending; tests the collateral policy, including how revaluation is really done; and looks at administration, monitoring, compliance, controls and the handling of exceptions. Reviewers should interview middle managers in every credit department and read individual files. Comparing applications appraised with those approved over the past 6 or 12 months, by number and value, is one gauge of appraisal quality.

Staffing

The review identifies the staff in origination, appraisal, supervision and monitoring, with their numbers, levels, ages, experience and duties, and measures their organisation, skills and qualifications against policy. Training for credit staff should be reviewed for adequacy, since its quality and frequency are usually a good guide to lending skill.

Information flows

Because lending is spread across the organisation, the bank needs efficient ways to check that guidelines are followed. An internal review and reporting system should show directors and senior managers how policy is applied and give them enough to judge junior officers and the state of the portfolio. Information is the raw material of credit management, so its availability, quality and cost deserve analysis, especially where it is scattered across the bank and must reach decision makers fully and on time. This work ties closely to reviews of human resources, organisation, controls and technology.

Questions for the board

The board must understand how credit risk is managed, and most large banks delegate this to a risk committee. Useful questions fall under a few themes.