Credit risk management is the governance, measurement, monitoring, and control of potential loss when borrowers or counterparties fail to perform.
Credit risk management is the governance, measurement, monitoring, and control of potential loss when borrowers, issuers, or counterparties fail to perform as agreed. It covers the full exposure lifecycle, from strategy and underwriting through administration, portfolio monitoring, problem-credit management, charge-off, and recovery.
The objective is not to eliminate credit risk. Lending and investing require accepting risk within approved limits for an expected return, while preserving the institution’s resilience under adverse conditions.
The Basel Committee’s current credit-risk principles organize sound practice around four broad areas:
| Area | Practical meaning |
|---|---|
| Credit-risk environment | Board-approved strategy, risk appetite, policies, responsibilities, and culture |
| Sound credit granting | Defined markets, borrower assessment, approval authority, terms, and connected exposure control |
| Administration, measurement, and monitoring | Complete files, accurate systems, ratings, limits, portfolio reporting, and early-warning review |
| Controls | Independent review, escalation, exception management, audit, and corrective action |
Implementation should match the institution’s size, business model, products, and risk profile. A community lender and a global bank will not use identical systems, but both need clear authority and traceable decisions.
Management translates the institution’s objectives into permitted products, markets, borrower types, risk grades, concentrations, tenors, collateral practices, and return requirements. Limits should cover individual obligors and connected groups as well as aggregate portfolios.
The lender verifies identity, purpose, repayment source, financial condition, structure, collateral, guarantees, legal capacity, and policy compliance. Approval should identify conditions and exceptions rather than assume documentation will resolve them later.
Accurate legal documents, liens, disbursement controls, system limits, covenants, payment schedules, and file maintenance turn an approved decision into an enforceable and monitorable exposure.
The institution tracks payment, financial reporting, covenant compliance, risk ratings, collateral, exceptions, concentration, exposure, and early-warning signals. Off-balance-sheet commitments and forborne or modified exposures also require monitoring.
When risk increases, the lender may increase review frequency, change classification, reduce exposure, seek more support, restructure, exercise rights, sell the asset, charge off an uncollectible amount, or pursue recovery. The response depends on evidence, contract, law, and expected economic outcome.
Assume a bank has a $2.0 billion loan portfolio and a board-approved limit restricting one industry to 15% of total loans.
The maximum exposure is:
$2.0 billion x 15% = $300 million.
Current exposure to the industry is $280 million. A proposed $50 million commitment would raise exposure to $330 million, or 16.5% of total loans.
The proposal exceeds the limit by $30 million. The bank should not hide this by considering only the amount currently expected to be drawn. A decision record could:
Even if the individual borrower is strong, the portfolio can still be over-concentrated. Conversely, staying below a percentage limit does not prove the exposure is prudent; underwriting, correlated risks, tenor, and stress loss still matter.
| Individual-credit view | Portfolio view |
|---|---|
| Borrower cash flow and willingness to pay | Common sensitivity across borrowers |
| Facility amount, maturity, and covenant | Product, industry, geography, and vintage concentration |
| Collateral, guarantee, and priority | Aggregate collateral or sponsor dependence |
| Internal risk grade | Grade distribution and migration |
| Expected recovery | Stress loss and capital or allowance capacity |
Good loans can create a weak portfolio if they share the same vulnerability. Diversification can reduce concentration, but correlations can rise during stress.
Credit risk management can use:
No metric is sufficient alone. A low historical default rate can coexist with rapid growth and weak underwriting, while a high allowance can reflect prudent recognition or severe underlying deterioration.
Business units commonly originate and own the risks they create. An independent risk function establishes challenge, measurement, monitoring, and escalation, while internal audit evaluates governance and control effectiveness. Exact organizational models vary.
Important controls include:
| Function | Primary focus |
|---|---|
| Credit analysis | Evaluating a borrower, issuer, facility, or transaction |
| Credit administration | Documentation, booking, collateral, covenant, and operational control |
| Credit risk management | Governing individual and portfolio risk across the lifecycle |
| Loan review | Independently assessing credit quality and process effectiveness |
| Collections or workout | Resolving delinquent or distressed exposures |
| Model risk management | Controlling risk from model development, use, and error |
The functions overlap but should not be collapsed into one vague responsibility.
Controls cannot eliminate uncertainty, fraud, legal disputes, correlated shocks, data errors, or unexpected market closure. Risk management can also become procyclical if standards loosen excessively in expansions and tighten indiscriminately during stress. Governance should support timely challenge without replacing sound judgment with a checklist.
This page is educational and is not regulatory, accounting, legal, lending, investment, or personalized financial advice.