Principles for the Management of Credit Risk

Principle 11: Banks must have information systems and analytical techniques that

enable management to measure the credit risk inherent in all on- and off-balance sheet

activities. The management information system should provide adequate information on

the composition of the credit portfolio, including identification of any concentrations of

risk.

61. Banks should have methodologies that enable them to quantify the risk involved in

exposures to individual borrowers or counterparties. Banks should also be able to analyse

credit risk at the product and portfolio level in order to identify any particular sensitivities or

concentrations. The measurement of credit risk should take account of (i) the specific nature

of the credit (loan, derivative, facility, etc.) and its contractual and financial conditions

(maturity, reference rate, etc.); (ii) the exposure profile until maturity in relation to potential

market movements; (iii) the existence of collateral or guarantees; and (iv) the potential for

default based on the internal risk rating. The analysis of credit risk data should be undertaken

at an appropriate frequency with the results reviewed against relevant limits. Banks should

use measurement techniques that are appropriate to the complexity and level of the risks

involved in their activities, based on robust data, and subject to periodic validation.

62. The effectiveness of a bank’s credit risk measurement process is highly dependent on

the quality of management information systems. The information generated from such

systems enables the board and all levels of management to fulfil their respective oversight

roles, including determining the adequate level of capital that the bank should be holding.

Therefore, the quality, detail and timeliness of information are critical. In particular,

information on the composition and quality of the various portfolios, including on a

consolidated bank basis, should permit management to assess quickly and accurately the level

of credit risk that the bank has incurred through its various activities and determine whether

the bank’s performance is meeting the credit risk strategy.

63. Banks should monitor actual exposures against established limits. It is important that

banks have a management information system in place to ensure that exposures approaching

risk limits are brought to the attention of senior management. All exposures should be

included in a risk limit measurement system. The bank’s information system should be able to

aggregate credit exposures to individual borrowers and counterparties and report on

exceptions to credit risk limits on a meaningful and timely basis.

64. Banks should have information systems in place that enable management to identify

any concentrations of risk within the credit portfolio. The adequacy of scope of information

should be reviewed on a periodic basis by business line managers and senior management to

ensure that it is sufficient to the complexity of the business. Increasingly, banks are also

designing information systems that permit additional analysis of the credit portfolio, including

stress testing.

Principle 12: Banks must have in place a system for monitoring the overall composition

and quality of the credit portfolio.

65. Traditionally, banks have focused on oversight of contractual performance of

individual credits in managing their overall credit risk. While this focus is important, banks

also need to have in place a system for monitoring the overall composition and quality of the

various credit portfolios. This system should be consistent with the nature, size and

complexity of the bank's portfolios.

66. A continuing source of credit-related problems in banks is concentrations within the

credit portfolio. Concentrations of risk can take many forms and can arise whenever a

significant number of credits have similar risk characteristics. Concentrations occur when,

among other things, a bank’s portfolio contains a high level of direct or indirect credits to (i) a

single counterparty, (ii) a group of connected counterparties11, (iii) a particular industry or

economic sector, (iv) a geographic region, (v) an individual foreign country or a group of

countries whose economies are strongly interrelated, (vi) a type of credit facility, or (vii) a

type of collateral. Concentrations also occur in credits with the same maturity. Concentrations

can stem from more complex or subtle linkages among credits in the portfolio. The

concentration of risk does not only apply to the granting of loans but to the whole range of

banking activities that, by their nature, involve counterparty risk. A high level of

concentration exposes the bank to adverse changes in the area in which the credits are

concentrated.

67. In many instances, due to a bank’s trade area, geographic location or lack of access

to economically diverse borrowers or counterparties, avoiding or reducing concentrations may

be extremely difficult. In addition, banks may want to capitalise on their expertise in a

particular industry or economic sector. A bank may also determine that it is being adequately

compensated for incurring certain concentrations of risk. Consequently, banks should not

necessarily forego booking sound credits solely on the basis of concentration. Banks may

need to make use of alternatives to reduce or mitigate concentrations. Such measures can

include pricing for the additional risk, increased holdings of capital to compensate for the

additional risks and making use of loan participations in order to reduce dependency on a

11 See footnote 5.

Credit risk management

22

particular sector of the economy or group of related borrowers. Banks must be careful not to

enter into transactions with borrowers or counterparties they do not know or engage in credit

activities they do not fully understand simply for the sake of diversification.

68. Banks have new possibilities to manage credit concentrations and other portfolio

issues. These include such mechanisms as loan sales, credit derivatives, securitisation

programs and other secondary loan markets. However, mechanisms to deal with portfolio

concentration issues involve risks that must also be identified and managed. Consequently,

when banks decide to utilise these mechanisms, they need to first have policies and

procedures, as well as adequate controls, in place.

Principle 13: Banks should take into consideration potential future changes in economic

conditions when assessing individual credits and their credit portfolios, and should

assess their credit risk exposures under stressful conditions.

69. An important element of sound credit risk management involves discussing what

could potentially go wrong with individual credits and within the various credit portfolios,

and factoring this information into the analysis of the adequacy of capital and provisions. This

“what if” exercise can reveal previously undetected areas of potential credit risk exposure for

the bank. The linkages between different categories of risk that are likely to emerge in times

of crisis should be fully understood. In case of adverse circumstances, there may be a

substantial correlation of various risks, especially credit and market risk. Scenario analysis

and stress testing are useful ways of assessing areas of potential problems.

70. Stress testing should involve identifying possible events or future changes in

economic conditions that could have unfavourable effects on a bank’s credit exposures and

assessing the bank’s ability to withstand such changes. Three areas that banks could usefully

examine are: (i) economic or industry downturns; (ii) market-risk events; and (iii) liquidity

conditions. Stress testing can range from relatively simple alterations in assumptions about

one or more financial, structural or economic variables to the use of highly sophisticated

financial models. Typically, the latter are used by large, internationally active banks.

71. Whatever the method of stress testing used, the output of the tests should be

reviewed periodically by senior management and appropriate action taken in cases where the

results exceed agreed tolerances. The output should also be incorporated into the process for

assigning and updating policies and limits.

72. The bank should attempt to identify the types of situations, such as economic

downturns, both in the whole economy or in particular sectors, higher than expected levels of

delinquencies and defaults, or the combinations of credit and market events, that could

produce substantial losses or liquidity problems. Such an analysis should be done on a

consolidated bank basis. Stress-test analyses should also include contingency plans regarding

actions management might take given certain scenarios. These can include such techniques as

hedging against the outcome or reducing the size of the exposure.

V. Ensuring Adequate Controls over Credit Risk

Principle 14: Banks must establish a system of independent, ongoing assessment of the

bank’s credit risk management processes and the results of such reviews should be

communicated directly to the board of directors and senior management.

73. Because various appointed individuals throughout a bank have the authority to grant

credit, the bank should have an efficient internal review and reporting system in order to

manage effectively the bank’s various portfolios. This system should provide the board of

directors and senior management with sufficient information to evaluate the performance of

account officers and the condition of the credit portfolio.

74. Internal credit reviews conducted by individuals independent from the business

function provide an important assessment of individual credits and the overall quality of the

credit portfolio. Such a credit review function can help evaluate the overall credit

administration process, determine the accuracy of internal risk ratings and judge whether the

account officer is properly monitoring individual credits. The credit review function should

report directly to the board of directors, a committee with audit responsibilities, or senior

management without lending authority (e.g., senior management within the risk control

function).

Principle 15: Banks must ensure that the credit-granting function is being properly

managed and that credit exposures are within levels consistent with prudential

standards and internal limits. Banks should establish and enforce internal controls and

other practices to ensure that exceptions to policies, procedures and limits are reported

in a timely manner to the appropriate level of management for action.

75. The goal of credit risk management is to maintain a bank’s credit risk exposure

within parameters set by the board of directors and senior management. The establishment

and enforcement of internal controls, operating limits and other practices will help ensure that

credit risk exposures do not exceed levels acceptable to the individual bank. Such a system

will enable bank management to monitor adherence to the established credit risk objectives.

76. Limit systems should ensure that granting of credit exceeding certain predetermined

levels receive prompt management attention. An appropriate limit system should assist

management in controlling credit risk exposures, initiating discussion about opportunities and

risks, and monitoring actual risk taking against predetermined credit risk tolerances.

77. Internal audits of the credit risk processes should be conducted on a periodic basis to

determine that credit activities are in compliance with the bank’s credit policies and

procedures, that credits are authorised within the guidelines established by the bank’s board of

directors and that the existence, quality and value of individual credits are accurately being

reported to senior management. Such audits should also be used to identify areas of weakness

in the credit risk management process, policies and procedures as well as any exceptions to

policies, procedures and limits.

Principle 16: Banks must have a system in place for early remedial action on

deteriorating credits, managing problem credits and similar workout situations.

78. One reason for establishing a systematic credit review process is to identify

weakened or problem credits.12 A reduction in credit quality should be recognised at an early

stage when there may be more options available for improving the credit. Banks must have a

disciplined and vigorous remedial management process, triggered by specific events, that is

administered through the credit administration and problem recognition systems.

79. A bank’s credit risk policies should clearly set out how the bank will manage

problem credits. Banks differ on the methods and organisation they use to manage problem

credits. Responsibility for such credits may be assigned to the originating business function, a

specialised workout section, or a combination of the two, depending upon the size and nature

of the credit and the reason for its problems.

80. Effective workout programs are critical to managing risk in the portfolio. When a

bank has significant credit-related problems, it is important to segregate the workout function

from the area that originated the credit. The additional resources, expertise and more

concentrated focus of a specialised workout section normally improve collection results. A

workout section can help develop an effective strategy to rehabilitate a troubled credit or to

12 See footnote 6.

increase the amount of repayment ultimately collected. An experienced workout section can

also provide valuable input into any credit restructurings organised by the business function.

VI. The Role of Supervisors

Principle 17: Supervisors should require that banks have an effective system in place to

identify, measure, monitor and control credit risk as part of an overall approach to risk

management. Supervisors should conduct an independent evaluation of a bank’s

strategies, policies, procedures and practices related to the granting of credit and the

ongoing management of the portfolio. Supervisors should consider setting prudential

limits to restrict bank exposures to single borrowers or groups of connected

counterparties.

81. Although the board of directors and senior management bear the ultimate

responsibility for an effective system of credit risk management, supervisors should, as part of

their ongoing supervisory activities, assess the system in place at individual banks to identify,

measure, monitor and control credit risk. This should include an assessment of any

measurement tools (such as internal risk ratings and credit risk models) used by the bank. In

addition, they should determine that the board of directors effectively oversees the credit risk

management process of the bank and that management monitors risk positions, and

compliance with and appropriateness of policies.

82. To evaluate the quality of credit risk management systems, supervisors can take a

number of approaches. A key element in such an evaluation is the determination by

supervisors that the bank is utilising sound asset valuation procedures. Most typically,

supervisors, or the external auditors on whose work they partially rely, conduct a review of

the quality of a sample of individual credits. In those instances where the supervisory analysis

agrees with the internal analysis conducted by the bank, a higher degree of dependence can be

placed on the use of such internal reviews for assessing the overall quality of the credit

portfolio and the adequacy of provisions and reserves13. Supervisors or external auditors

should also assess the quality of a bank’s own internal validation process where internal risk

13 The New Capital Adequacy Framework anticipates that, subject to supervisory approval, banks’ internal rating

methodologies may be used as a basis for regulatory capital calculation. Guidance to supervisors specific to this purpose

will be published in due course.

ratings and/or credit risk models are used. Supervisors should also review the results of any

independent internal reviews of the credit-granting and credit administration functions.

Supervisors should also make use of any reviews conducted by the bank’s external auditors,

where available.

83. Supervisors should take particular note of whether bank management recognises

problem credits at an early stage and takes the appropriate actions.14 Supervisors should

monitor trends within a bank’s overall credit portfolio and discuss with senior management

any marked deterioration. Supervisors should also assess whether the capital of the bank, in

addition to its provisions and reserves, is adequate related to the level of credit risk identified

and inherent in the bank’s various on- and off-balance sheet activities.

84. In reviewing the adequacy of the credit risk management process, home country

supervisors should also determine that the process is effective across business lines,

subsidiaries and national boundaries. It is important that supervisors evaluate the credit risk

management system not only at the level of individual businesses or legal entities but also

across the wide spectrum of activities and subsidiaries within the consolidated banking

organisation.

85. After the credit risk management process is evaluated, the supervisors should address

with management any weaknesses detected in the system, excess concentrations, the

classification of problem credits and the estimation of any additional provisions and the effect

on the bank’s profitability of any suspension of interest accruals. In those instances where

supervisors determine that a bank’s overall credit risk management system is not adequate or

effective for that bank’s specific credit risk profile, they should ensure the bank takes the

appropriate actions to improve promptly its credit risk management process.

86. Supervisors should consider setting prudential limits (e.g., large exposure limits) that

would apply to all banks, irrespective of the quality of their credit risk management process.

Such limits would include restricting bank exposures to single borrowers or groups of

connected counterparties. Supervisors may also want to impose certain reporting requirements

for credits of a particular type or exceeding certain established levels. In particular, special

attention needs to be paid to credits granted to counterparties “connected” to the bank, or to

each other.

14 See footnote 6.

Appendix

Common Sources of Major Credit Problems

1. Most major banking problems have been either explicitly or indirectly caused by

weaknesses in credit risk management. In supervisors’ experience, certain key problems tend

to recur. Severe credit losses in a banking system usually reflect simultaneous problems in

several areas, such as concentrations, failures of due diligence and inadequate monitoring.

This appendix summarises some of the most common problems related to the broad areas of

concentrations, credit processing, and market- and liquidity-sensitive credit exposures.

Concentrations

2. Concentrations are probably the single most important cause of major credit

problems. Credit concentrations are viewed as any exposure where the potential losses are

large relative to the bank’s capital, its total assets or, where adequate measures exist, the

bank’s overall risk level. Relatively large losses15 may reflect not only large exposures, but

also the potential for unusually high percentage losses given default.

3. Credit concentrations can further be grouped roughly into two categories:

• Conventional credit concentrations would include concentrations of credits to

single borrowers or counterparties, a group of connected counterparties, and sectors

or industries, such as commercial real estate, and oil and gas.

• Concentrations based on common or correlated risk factors reflect subtler or

more situation-specific factors, and often can only be uncovered through analysis.

Disturbances in Asia and Russia in late 1998 illustrate how close linkages among

emerging markets under stress conditions and previously undetected correlations

between market and credit risks, as well as between those risks and liquidity risk, can

produce widespread losses.

4. Examples of concentrations based on the potential for unusually deep losses often embody factors such as leverage, optionality, correlation of risk factors and structured financings that concentrate risk in certain tranches. For example, a highly leveraged borrower

15 Losses are equal to the exposure times the percentage loss given the event of default.

will likely produce larger credit losses for a given severe price or economic shock than a less leveraged borrower whose capital can absorb a significant portion of any loss. The onset of exchange rate devaluations in late 1997 in Asia revealed the correlation between exchange rate devaluation and declines in financial condition of foreign exchange derivative counterparties resident in the devaluing country, producing very substantial losses relative to

notional amounts of those derivatives. The risk in a pool of assets can be concentrated in a securitisation into subordinated tranches and claims on leveraged special purpose vehicles, which in a downturn would suffer substantial losses.

5. The recurrent nature of credit concentration problems, especially involving conventional credit concentrations, raises the issue of why banks allow concentrations to develop. First, in developing their business strategy, most banks face an inherent trade-off between choosing to specialise in a few key areas with the goal of achieving a market leadership position and diversifying their income streams, especially when they are engaged

in some volatile market segments. This trade-off has been exacerbated by intensified

competition among banks and non-banks alike for traditional banking activities, such as

providing credit to investment grade corporations. Concentrations appear most frequently to

arise because banks identify “hot” and rapidly growing industries and use overly optimistic

assumptions about an industry’s future prospects, especially asset appreciation and the

potential to earn above-average fees and/or spreads. Banks seem most susceptible to

overlooking the dangers in such situations when they are focused on asset growth or market

share.

6. Banking supervisors should have specific regulations limiting concentrations to one

borrower or set of related borrowers, and, in fact, should also expect banks to set much lower

limits on single-obligor exposure. Most credit risk managers in banks also monitor industry

concentrations. Many banks are exploring techniques to identify concentrations based on

common risk factors or correlations among factors. While small banks may find it difficult not

to be at or near limits on concentrations, very large banking organisations must recognise that,

because of their large capital base, their exposures to single obligors can reach imprudent