| Guidelines This chapter sets out principles for managing credit risk in four key areas: (i) establishing a suitable credit risk environment; (ii) operating under a sound credit-granting process; (iii) maintaining an appropriate credit administration, measurement and monitoring process; and (iv) ensuring adequate controls over credit risk. The contents of this chapter are based on:
|
| Related standards |
| Related guidelines |
| Other related publications
|
The effective management of credit risk is a critical component of a comprehensive approach to risk management. Banks need to manage the credit risk inherent in the entire portfolio as well as the risk in individual credits or transactions. Banks should also consider the relationships between credit risk and other risks.
The principles for the management of credit risk provide guidelines for banking supervisory authorities to evaluate banks’ credit risk management processes in four key areas: (i) establishing a suitable credit risk environment; (ii) operating under a sound credit-granting process; (iii) maintaining an appropriate credit administration, measurement and monitoring process; and (iv) ensuring adequate controls over credit risk.
Principle 1: The board of directors should have responsibility for approving and periodically (at least annually) reviewing the credit risk strategy and significant credit risk policies of the bank. The strategy should reflect the bank’s tolerance for risk and the level of sustainable returns the bank expects to achieve for incurring various credit risks, taking into account market conditions, macroeconomic factors and forward-looking information.
As with all other areas of a bank’s activities, the board of directors has a critical role to play in overseeing the credit-granting and credit risk management functions of the bank. Each bank should develop a credit risk strategy that establishes the objectives guiding the bank’s credit-granting activities and adopt the necessary policies and procedures for conducting such activities. The credit risk strategy, as well as significant credit risk policies for identifying, measuring, evaluating, monitoring, reporting and controlling or mitigating credit risk (including counterparty credit risk), should be approved and periodically (at least annually) reviewed by the board of directors. The board oversees management in a way that ensures that these policies are implemented effectively and fully integrated into the bank’s overall risk management process. The board needs to recognise that the strategy and policies must cover the many activities of the bank in which credit exposure is a significant risk.
The credit risk strategy should include a statement of the bank’s willingness to grant credit based on exposure type (for example, commercial, consumer, real estate), economic sector, geographical location, currency, maturity and anticipated profitability. This might also include the identification of target markets and the overall characteristics that the bank would want to achieve in its credit portfolio (including levels of diversification and concentration tolerances).
The credit risk strategy should give recognition to the goals of credit quality, earnings and growth.
The credit risk strategy of any bank should provide continuity in approach. Therefore, the strategy will need to take into account the cyclical aspects of any economy and the resulting shifts in the composition and quality of the overall credit portfolio. Although the strategy should be periodically assessed and amended, it should be viable in the long-run and through various economic cycles.
The credit risk strategy and policies should be effectively communicated throughout the bank. All relevant personnel should clearly understand the bank’s approach to granting and managing credit and should be held accountable for complying with established policies and procedures.
The board should ensure that senior management is fully capable of managing the credit activities conducted by the bank and that such activities are done within the risk strategy, policies and tolerances approved by the board. The board should also regularly (ie at least annually), either within the credit risk strategy or within a statement of credit policy, approve the bank’s overall credit-granting criteria (including general terms and conditions). In addition, it should approve the way the bank will organise its credit-granting functions, including independent review of the credit-granting and management function and the overall portfolio.
Once a potential credit is introduced, the bank’s established processes should determine how much and at what terms credit is granted. To avoid conflicts of interest, it is important that board members not override the credit-granting and monitoring processes of the bank. Board members with conflicts of interest are excluded from the approval process for granting and managing related-party transactions.
The board of directors should ensure that the bank’s remuneration policies do not contradict its credit risk strategy. Remuneration policies that reward unacceptable behaviour such as generating short-term profits while deviating from credit policies or exceeding established limits weaken the bank’s credit processes.
Principle 2: Senior management should have responsibility for implementing the credit risk strategy approved by the board of directors and for developing policies and procedures for identifying, measuring, evaluating, monitoring, reporting and controlling or mitigating credit risk (including counterparty credit risk). Such policies and procedures should address credit risk in all of the bank’s activities and at both the individual credit and portfolio levels.
Senior management is responsible for ensuring that the bank’s credit-granting activities conform to the established credit risk strategy, that written procedures are developed and implemented, and that loan approval and review responsibilities are clearly and properly assigned. Senior management must also ensure that there is a periodic independent internal assessment of the bank’s credit-granting and management functions.1
| 1 | This may be difficult for very small banks; however, there should be adequate checks and balances in place to promote sound credit decisions. |
Banks should design and implement written policies and sound procedures related to identifying, measuring, evaluating, monitoring, reporting and controlling or mitigating credit risk (including counterparty credit risk). Credit risk policies establish the framework for lending and guide the credit-granting activities of the bank. Credit risk policies should address such topics as target markets, portfolio mix, price and non-price terms, the structure of limits, approval authorities, exception processing/reporting, etc. Such policies should be clearly defined, consistent with prudent banking practices and relevant regulatory requirements, and adequate for the nature and complexity of the bank’s activities. The policies should be designed and implemented considering current and forward-looking internal and external conditions such as the bank’s market position, trade area, staff capabilities and technology. Policies and procedures that are properly developed and implemented enable the bank to:
Implemented credit risk policies and procedures should ensure that the credit portfolio is adequately diversified given the bank’s target markets and overall credit risk strategy. Such policies should establish targets for portfolio mix as well as set exposure limits on single counterparties and groups of connected counterparties, considering industries or economic sectors, geographic regions and specific products. Banks should ensure that their own internal exposure limits comply with any prudential limits or restrictions set by the banking supervisors.
Credit risk policies should be communicated throughout the organisation, implemented through appropriate procedures, monitored and periodically revised to take into account changing internal and external circumstances. They should be applied, where appropriate, on a consolidated bank basis and at the level of individual affiliates. In addition, the policies should address equally the important functions of reviewing credits on an individual basis and ensuring appropriate diversification at the portfolio level.
Banks that engage in granting credit internationally undertake, in addition to standard credit risk, risks associated with conditions in the home country of a foreign borrower or counterparty, including country risk and transfer risk.2 In all instances of international transactions, banks should understand the globalisation of financial markets and the potential for spillover effects from one country to another or contagion effects for an entire region.
Banks that engage in granting credit internationally must therefore have adequate policies and procedures for identifying, measuring, evaluating, monitoring, reporting and controlling or mitigating country risk and transfer risk in their international lending and investment activities on a timely basis. The monitoring of country risk factors should incorporate (i) the potential default of foreign private sector counterparties arising from country-specific economic factors and (ii) the enforceability of loan agreements and the timing and ability to realise collateral under the national legal framework.
Principle 3: Banks should identify and manage credit risk inherent in all products and activities. Banks should ensure that the risks of products and activities new to them are subject to adequate risk management procedures and controls before being introduced or undertaken and approved in advance by the board of directors or its appropriate committee.
Banks should identify all credit risks inherent in the products they offer and the activities in which they engage, including all on-balance and off-balance sheet exposures. Such identification stems from a careful review of the existing and potential credit risk characteristics of the product or activity.
Banks should have a clear understanding of the credit risks involved in more complex credit-granting activities (for example, loans to certain industry sectors, securitisation activities, customer-written options, credit derivatives, credit-linked notes). This is particularly important because the credit risk involved, while not new to banking, may be less obvious and require more analysis than the risk of more traditional credit-granting activities. Although more complex credit-granting activities may require tailored procedures and controls, the basic principles of credit risk management will still apply.
It is critical that senior management determine that the staff involved in any activity where there is material credit risk (including counterparty credit risk), whether established or new, basic or more complex, be fully capable of conducting the activity to the highest standards and in compliance with the bank’s policies, procedures and limits.
Principle 4: Banks must operate within sound, well-defined credit-granting criteria. These criteria should include a clear indication of the bank’s target market and a thorough understanding of the risk profile and characteristics of the borrower or counterparty, as well as the purpose and structure of the credit, and its source of repayment.
Establishing sound, well-defined credit-granting criteria is essential to approving credit in a safe and sound manner. The criteria should set out who is eligible for credit and for how much, what types of credit are available, and under what terms and conditions the credits should be granted.
Banks must receive sufficient information to ensure a thorough understanding of the risk profile and characteristics of the borrowers (and, in the case of securitisation exposures, all features of securitisation transactions) that would materially impact the performance of the respective exposures. Depending on the type of credit exposure and the nature of the credit relationship to date, the factors to be considered and documented in approving credits include:
In addition, in approving borrowers or counterparties for the first time, consideration should be given to the integrity and reputation of the borrower or counterparty as well as their legal capacity to assume the liability. Once credit-granting criteria have been established, it is essential for the bank to ensure that the information it receives is sufficient to make proper credit-granting decisions. This information will also serve as the basis for rating the credit under the bank’s internal risk rating system.
Banks need to understand to whom they are granting credit. Therefore, prior to entering into any new credit relationship, banks must become familiar with the borrower or counterparty and be confident that they are dealing with an individual or organisation of sound repute and creditworthiness. In particular, strict policies must be in place to avoid association with individuals involved in fraudulent activities and other crimes. This can be achieved through a number of ways, including asking for references from known parties, accessing credit registries, and becoming familiar with individuals responsible for managing a company and checking their personal references and financial condition. However, a bank should not grant credit simply because the borrower or counterparty is familiar to the bank or is perceived to be highly reputable.
Banks should have procedures to identify situations where, in considering credits, it is appropriate to classify a group of obligors as connected counterparties and, thus, as a single obligor. This would include aggregating exposures to groups of accounts exhibiting financial interdependence, including corporate or non-corporate, where they are under common ownership or control or with strong connecting links (for example, common management, familial ties).3 Banks should also have procedures for aggregating exposures to individual clients across business activities.
Many banks participate in loan syndications or other such loan consortia. Some banks place undue reliance on the credit risk analysis done by the lead underwriter or on external commercial loan credit ratings. All syndicate participants should perform their own due diligence, including independent credit risk analysis and review of syndicate terms prior to committing to the syndication. Each bank should analyse the risk and return on syndicated loans in the same manner as directly sourced loans.
Granting credit involves accepting risks as well as producing profits. Banks should assess the risk/reward relationship in any credit as well as the overall profitability of the account relationship. In evaluating whether, and on what terms, to grant credit, banks need to assess the risks against expected return, factoring in, to the greatest extent possible, price and non-price (eg collateral, restrictive covenants, etc) terms. In evaluating risk, banks should also assess likely downside scenarios and their possible impact on borrowers or counterparties. A common problem among banks is the tendency not to price a credit or overall relationship properly and therefore not receive adequate compensation for the risks incurred.
In considering potential credits, banks must recognise the necessity of establishing provisions for identified and expected losses and holding adequate capital to absorb unexpected losses. The bank should factor these considerations into credit-granting decisions, as well as into the overall portfolio risk management process.4
Banks can utilise transaction structure, collateral and guarantees to help mitigate risks (both identified and inherent) in individual credits but transactions should be entered into primarily on the strength of the borrower’s repayment capacity or the counterparty’s financial position. Collateral cannot be a substitute for a comprehensive assessment of the borrower or counterparty, nor can it compensate for insufficient information. It should be recognised that any credit enforcement actions (eg foreclosure proceedings) can eliminate the profit margin on the transaction. In addition, banks need to be mindful that the value of collateral may well be impaired by the same factors that have led to the diminished recoverability of the credit. Banks should have policies covering the acceptability of various forms of collateral, procedures for the ongoing valuation of such collateral, and a process to ensure that collateral is, and continues to be, enforceable and realisable. With regard to guarantees, banks should evaluate the level of coverage being provided in relation to the credit-quality and legal capacity of the guarantor. Banks should be careful when making assumptions about implied support from third parties such as the government.
Where actual or potential conflicts of interest exist within the bank, internal confidentiality arrangements (eg “Chinese walls”) should be established to ensure that there is no hindrance to the bank obtaining all relevant information from the borrower.
Principle 5: Banks should establish overall credit limits at the level of individual borrowers and counterparties, and groups of connected counterparties that aggregate in a comparable and meaningful manner different types of exposures, both in the banking and trading book and on and off the balance sheet.
An important element of credit risk management is the establishment of exposure limits on single counterparties and groups of connected counterparties. Such limits are frequently based in part on the internal risk rating assigned to the borrower or counterparty, with borrowers or counterparties assigned better risk ratings having potentially higher exposure limits. Limits should also be established for particular industries or economic sectors, geographic regions and specific products.
Exposure limits are needed in all areas of the bank’s activities that involve credit risk. These limits help to ensure that the bank’s credit-granting activities are adequately diversified. As mentioned earlier, much of the credit exposure faced by some banks comes from activities and instruments in the trading book and off the balance sheet. Limits on such transactions are particularly effective in managing the overall credit risk profile or counterparty risk of a bank. In order to be effective, limits should generally be binding and not driven by customer demand.
Effective measures of future exposure, such as potential future exposures or alternative metrics, are essential for the establishment of meaningful limits, placing an upper bound on the overall scale of activity with, and exposure to, a given counterparty, based on a comparable measure of exposure across a bank’s various activities (both on- and off-balance sheet).
Banks should consider the results of stress testing in the overall limit setting and monitoring process. Such stress testing should take into consideration economic cycles, interest rate and other market movements, and liquidity conditions.
Bank’s credit limits should recognise and reflect the risks associated with the near-term liquidation of positions in the event of borrower or counterparty default. Limits should also factor in any unsecured exposure in a liquidation scenario. Where a bank has several transactions with a counterparty, its future exposure to that counterparty is likely to vary significantly and discontinuously over the maturity over which the measure of such exposure is calculated. Measures of future exposures should therefore be calculated over multiple time horizons.
Principle 6: Banks should have a clearly established process in place for approving new credits as well as amending, renewing and refinancing existing credits and ensuring a thorough understanding of the risk profile and characteristics of the borrowers or counterparties.
Many individuals within a bank are involved in the credit-granting process. These include individuals from the business origination function, the credit analysis function and the credit approval function. In addition, the same counterparty may be approaching several different areas of the bank for various forms of credit. Banks may choose to assign responsibilities in different ways; however, it is important that the credit-granting process coordinate the efforts of all of the various individuals in order to ensure that sound credit decisions are made.
In order to maintain a sound credit portfolio, a bank must have an established formal transaction evaluation and approval process for the granting of credits, ensuring a thorough understanding of the risk profile and characteristics of the borrowers (and, in the case of securitisation exposures, all features of securitisation transactions that would materially impact the performance of the respective exposures). Approvals should be made in accordance with the bank’s written guidelines and granted by the appropriate level of management. There should be a clear audit trail documenting that the approval process was complied with and identifying the individual(s) and/or committee(s) providing input as well as making the credit decision. Banks often benefit from the establishment of specialist credit groups to analyse and approve credits related to significant product lines, types of credit facilities and industrial and geographic sectors. Banks should invest in adequate credit decision resources so that they are able to make sound credit decisions consistent with their credit strategy and meet competitive time, pricing and structuring pressures.
Each credit proposal should be subject to careful analysis by a qualified credit analyst with expertise commensurate with the size and complexity of the transaction. An effective evaluation process establishes minimum requirements for the information on which the analysis is to be based. There should be policies in place regarding the information and documentation needed to approve new credits, renew existing credits and/or change the terms and conditions of previously approved credits. The information received will be the basis for any internal evaluation or rating assigned to the credit, and its accuracy and adequacy is critical to management making appropriate judgments about the acceptability of the credit.
Banks should maintain a corps of credit risk officers who have the experience, knowledge and background to exercise prudent judgment in assessing, approving and managing credit risks. A bank’s credit-granting approval process should establish accountability for decisions taken and designate who has the absolute authority to approve credits or changes in credit terms. Banks typically utilise a combination of individual signature authority, dual or joint authorities, and a credit approval group or committee, depending upon the size and nature of the credit. Approval authorities should be commensurate with the expertise of the individuals involved.
Principle 7: All extensions of credit must be made on an arm’s-length basis. In particular, credits to related companies and individuals must be authorised on an exception basis and monitored with particular care, and other steps to control or mitigate the risks of non-arm’s length lending must be taken as appropriate.
Principle 8: Banks should have in place a system for the ongoing administration of their various credit risk-bearing portfolios.
Credit administration is a critical element in maintaining the safety and soundness of a bank. Once a credit is granted, it is the responsibility of the business unit, often in conjunction with a credit administration support team, to ensure that the credit is properly maintained. This includes keeping the credit file up to date, obtaining current financial information, sending out renewal notices and preparing various documents such as loan agreements.
Given the wide range of responsibilities of the credit administration function, its organisational structure varies with the size and sophistication of the bank. In larger banks, responsibilities for the various components of credit administration are usually assigned to different departments. In smaller banks, a few individuals might handle several of the functional areas. Where individuals perform such sensitive functions as custody of key documents, wiring out funds or entering limits into the computer database, they should report to managers who are independent of the business origination and credit approval processes.
Bank’s credit administration should ensure:
For the various components of credit administration to function appropriately, senior management must understand and demonstrate that it recognises the importance of this element of monitoring and controlling credit risk.
The credit files should include all of the information necessary to ascertain the current financial condition of the borrower or counterparty as well as sufficient information to track the decisions made and the history of the credit. For example, the credit files should include current financial statements, financial analyses and internal risk rating documentation, internal memoranda, reference letters and appraisals. The loan review function should determine that the credit files are complete and that all loan approvals and other necessary documents have been obtained.
Principle 9: Banks must have in place policies, processes and methodologies for grading, classifying and monitoring all credit exposures (including off-balance sheet and forborne exposures), including establishing provisions and ensuring appropriate and robust provisioning levels.
Banks must have comprehensive policies, processes and methodologies for grading, classifying and monitoring all credit exposures (including off-balance sheet and forborne exposures) of individual credits and single obligors across the bank’s various portfolios or at a portfolio level for credit exposures with homogeneous characteristics. These processes, policies and methodologies need to define criteria for identifying and reporting potential problem exposures in a timely manner to ensure that they are subject to more frequent monitoring as well as possible corrective action, classification and/or provisioning.
An effective credit monitoring system will include measures to:
Specific individuals should be responsible for monitoring credit quality, including ensuring that relevant information is passed to those responsible for assigning internal risk ratings to the credit. In addition, individuals should be made responsible for monitoring on an ongoing basis any underlying collateral and guarantees. Such monitoring will ensure that prompt action is taken at the appropriate level of the bank’s senior management or board, assist the bank in making necessary changes to contractual arrangements as well as maintain adequate provisions and reserves for credit losses. In assigning these responsibilities, bank management should recognise the potential for conflicts of interest, especially for personnel who are judged and rewarded on such indicators as loan volume, portfolio quality or short-term profitability.
Principle 10: Banks are encouraged to develop and utilise an internal risk rating system in managing credit risk. The rating system should be consistent with the nature, size and complexity of a bank’s activities.
Internal risk ratings are an important tool in monitoring credit risk. Internal risk ratings should be adequate to support the identification and measurement of risk from all credit exposures and should be integrated into a bank’s overall analysis of credit risk and capital adequacy. The ratings system should provide detailed ratings for all exposures, not only for criticised or problem exposures. This will allow more accurate determination of the overall characteristics of the credit portfolio, concentrations, problem exposures and the adequacy of credit loss reserves and provisions. More detailed and sophisticated internal risk rating systems, used primarily at larger banks, can also be used to determine internal capital allocation, pricing of credits and profitability of transactions and relationships.
Typically, an internal risk rating system categorises credits into various classes designed to take into account gradations in risk. Simpler systems might be based on several categories ranging from satisfactory to unsatisfactory; however, more meaningful systems will have numerous gradations for credits considered satisfactory in order to truly differentiate the relative credit risk they pose. In developing their systems, banks must decide whether to rate the riskiness of the borrower or counterparty, the risks associated with a specific transaction, or both.
Internal risk ratings are an important tool in monitoring and controlling credit risk. In order to facilitate early identification of changes in risk profiles, the bank’s internal risk rating system should be responsive to indicators of potential or actual deterioration in credit risk. Credits with deteriorating ratings should be subject to additional oversight and monitoring, for example, through more frequent visits from credit officers and inclusion on a watchlist that is regularly reviewed by senior management. The internal risk ratings can be used by line management in different departments to track the current characteristics of the credit portfolio and help determine necessary changes to the credit strategy of the bank. Consequently, it is important that the board of directors and senior management also receive periodic reports on the condition of the credit portfolios based on such ratings.
The ratings assigned to individual borrowers or counterparties at the time the credit is granted must be reviewed on a periodic basis, and individual credits should be assigned a new rating when conditions either improve or deteriorate. Because of the importance of ensuring that internal risk ratings are consistent and accurately reflect the quality of individual credits, responsibility for setting or confirming such ratings should rest with a credit review function independent of that which originated the credit concerned. It is also important that the consistency and accuracy of ratings are examined periodically by a function such as an independent credit review group.
Principle 11: Banks must have information systems and analytical techniques that enable management to measure the credit risk inherent in all on- and off-balance sheet activities. The management information system should provide adequate information on the composition of the credit portfolio, including identification of any concentrations of risk.
Banks should have methodologies that enable them to quantify the risk involved in exposures to individual borrowers or counterparties. Banks should also be able to analyse credit risk at the product and portfolio level in order to identify any particular sensitivities or concentrations. The measurement of credit risk should take account of (i) the specific nature of the credit (loan, derivative, facility, etc) and its contractual and financial conditions (maturity, reference rate, etc); (ii) the exposure profile until maturity in relation to potential market movements; (iii) the existence of collateral or guarantees; and (iv) the potential for default based on the internal risk rating. The analysis of credit risk data should be undertaken at an appropriate frequency with the results reviewed against relevant limits. Banks should use measurement techniques that are appropriate to the complexity and level of the risks involved in their activities, based on robust data and subject to periodic validation.
The effectiveness of a bank’s credit risk measurement process is highly dependent on the quality of management information systems. The information generated from such systems enables the board and all levels of management to fulfil their respective oversight roles, including determining the adequate level of capital that the bank should be holding. Therefore, the quality, detail and timeliness of information are critical. In particular, information on the composition and quality of the various portfolios, including on a consolidated bank basis, should permit management to assess quickly and accurately the level of credit risk that the bank has incurred through its various activities and determine whether the bank’s performance is meeting the credit risk strategy.
Banks should monitor actual exposures against established limits. It is important that banks have a management information system in place to ensure that exposures approaching risk limits are brought to the attention of senior management. All exposures should be included in a risk limit measurement system. The bank’s information system should be able to aggregate credit exposures to individual borrowers and counterparties and report on exceptions to credit risk limits on a meaningful and timely basis.
Banks should have policies and processes that provide a comprehensive bank-wide view of significant sources of concentration risk.6 Exposures (including counterparty credit risk exposure) arising from off-balance sheet as well as on-balance sheet items included in both the banking book and trading book are captured.
| 6 | Concentration risk may result from credit, market and other risk where a bank is overly exposed to particular asset classes, products, collateral, currencies or funding sources, and is broader than exposures subject to large exposure requirements. Credit concentrations include exposures to single counterparties (including collateral credit protection and other commitments provided); groups of connected counterparties; counterparties in the same industry, economic sector or geographic region; and counterparties whose financial performance is dependent on the same activity or commodity (see BCP40.44 footnote 53). |
Banks should have information systems in place that identify and aggregate on a timely basis exposures creating risk concentrations and large exposures to single counterparties or groups of connected counterparties and that facilitate active management of such exposures. The adequacy of the scope of information should be reviewed on a periodic basis by business line managers and senior management to ensure that it is sufficient for the complexity of the business. In addition, it should be sufficiently flexible so that the bank can generate forward-looking enterprise-wide scenario analyses that capture management’s interpretation of evolving market conditions and stressed conditions.
In many instances, due to a bank’s trade area, geographic location or lack of access to economically diverse borrowers or counterparties, avoiding or reducing concentrations may be extremely difficult. In addition, banks may want to capitalise on their expertise in a particular industry or economic sector. A bank may also determine that it is being adequately compensated for incurring certain concentrations of risk. Consequently, banks should not necessarily forego booking sound credits solely on the basis of concentration. Banks may need to make use of alternatives to reduce or mitigate concentrations. Such measures can include pricing for the additional risk, adopting appropriate credit risk mitigation measures (eg collateralisation), increasing holdings of capital to compensate for the additional risks and making use of loan participations in order to reduce dependency on a particular sector of the economy or group of related borrowers or counterparties. Banks must be careful not to enter into transactions with borrowers or counterparties they do not know or to engage in credit activities they do not fully understand simply for the sake of diversification.
Banks may actively manage credit concentrations and other portfolio issues through mechanisms such as loan sales, credit derivatives, securitisation programs and other secondary loan markets. However, mechanisms to deal with portfolio concentration issues involve risks that must also be identified and managed. Consequently, when banks decide to utilise these mechanisms, they need to first have policies and procedures, as well as adequate controls, in place.
Principle 12: Banks should take into consideration current and forward-looking market and macroeconomic factors when assessing individual credits and their credit portfolios, and they should assess their credit risk exposures under stressful conditions.
An important element of sound credit risk management involves discussing what could potentially go wrong with individual credits and within the various credit portfolios and factoring this information into the analysis of the adequacy of capital and provisions. This “what if” exercise can reveal previously undetected areas of potential credit risk exposure for the bank. The linkages between different categories of risk that are likely to emerge in times of crisis should be fully understood. In case of adverse circumstances, there may be a substantial correlation of various risks, especially credit and market risk. Scenario analysis and stress testing are useful ways of assessing areas of potential problems.
Stress test results should be reported to the board and senior management on a regular basis, at relevant levels of aggregation. Results of stress tests should, where appropriate, inform banks’ calibration of limits.
The bank should attempt to identify the types of situations, such as economic downturns, both in the whole economy and in particular sectors, higher than expected levels of delinquencies and defaults, or the combinations of credit and market events, that could produce substantial losses or liquidity problems. Such an analysis should be done at relevant levels of its organisation, consistent with the stress test objectives (eg at a portfolio level, a business unit level or at a bank-wide level (consolidation, solo or sub-consolidated)). Stress test analyses should also include contingency plans regarding actions management might take given certain scenarios. These can include such techniques as hedging against the outcome or reducing the size of the exposure.
Principle 13: Banks must establish a system of independent, ongoing assessment of the bank’s credit risk management processes, and the results of such reviews should be communicated directly to the board of directors and senior management.
Because various appointed individuals throughout a bank have the authority to grant credit, the bank should have an efficient internal review and reporting system in order to manage effectively the bank’s various portfolios. This system should provide the board of directors and senior management with sufficient information to evaluate the performance of account officers and approval officers and the condition of the credit portfolio.
Internal credit reviews conducted by individuals independent from the business function provide an important assessment of individual credits and the overall quality of the credit portfolio. Such a credit review function can help evaluate the overall credit administration process, determine the accuracy of internal risk ratings and judge whether the account officer is properly monitoring individual credits. The credit review function should report directly to the board of directors, a committee with audit responsibilities or senior management without lending authority (eg senior management within the risk control function).
Principle 14: Banks must ensure that the credit-granting function is being properly managed and that credit exposures are within levels consistent with prudential standards and internal limits. Banks should establish and enforce internal controls and other practices to ensure that exceptions to policies, procedures and limits are reported in a timely manner to the appropriate level of management for action.
The goal of credit risk management is to maintain a bank’s credit risk exposure within parameters set by the board of directors and senior management. The establishment and enforcement of internal controls, operating limits and other practices will help ensure that credit risk exposures do not exceed levels acceptable to the individual bank. Such a system will enable bank management to monitor adherence to the established credit risk objectives.
Limit systems should ensure that granting of credit exceeding certain predetermined levels receives prompt management attention. An appropriate limit system should assist management in controlling credit risk exposures, initiating discussion about opportunities and risks, and monitoring actual risk taking against predetermined credit risk tolerances.
Internal audits of the credit risk processes should be conducted on a periodic basis to determine that credit activities are in compliance with the bank’s credit policies and procedures, that credits are authorised within the guidelines established by the bank’s board of directors and that the existence, quality and value of individual credits are accurately being reported to senior management. Such audits should also be used to identify areas of weakness in the credit risk management process, policies and procedures as well as any exceptions to policies, procedures and limits.
Principle 15: Banks must have a system in place for early remedial action on deteriorating credits, managing problem exposures and similar workout situations.
One reason for establishing a systematic credit review process is to identify weakened or problem exposures. A reduction in credit quality should be recognised at an early stage when there may be more options available for improving the credit. Banks must have a disciplined and vigorous remedial management process, triggered by specific events, that is administered through the credit administration and problem recognition systems.
A bank’s credit risk policies should clearly set out how the bank will manage problem exposures. Banks differ on the methods and organisation they use to manage problem exposures. Responsibility for such exposures may be assigned to the originating business function, a specialised workout section or a combination of the two, depending upon the size and nature of the exposure and the reason for its problems.
Effective workout programs are critical to managing risk in the portfolio. When a bank has significant credit-related problems, it is important to segregate the workout function from the area that originated the credit. The additional resources, expertise and more concentrated focus of a specialised workout section normally improve collection results. A workout section can help develop an effective strategy to rehabilitate a troubled credit or to increase the amount of repayment ultimately collected. An experienced workout section can also provide valuable input into any credit restructurings organised by the business function.
Principle 16: Supervisors should require that banks have an effective system in place to identify, measure, evaluate, monitor, report and control or mitigate credit risk (including counterparty credit risk) as part of an overall approach to risk management. Supervisors should conduct an independent evaluation of a bank’s strategies, policies, procedures and practices related to the granting of credit and the ongoing management of the portfolio. Supervisors set prudential limits to restrict bank exposures to single counterparties or groups of connected counterparties.
Although the board of directors and senior management bear the ultimate responsibility for an effective system of credit risk management, supervisors should, as part of their ongoing supervisory activities, assess the system in place at individual banks to identify, measure, evaluate, monitor, report and control or mitigate credit risk. This should include an assessment of any measurement tools (such as internal risk ratings and credit risk models) used by the bank. In addition, they should determine that the board of directors effectively oversees the credit risk management process of the bank and that management monitors risk positions, and compliance with and appropriateness of policies.
To evaluate the quality of credit risk management systems, supervisors can take a number of approaches. A key element in such an evaluation is the determination by supervisors that the bank is utilising sound asset valuation procedures. Most typically, supervisors, or the external auditors on whose work they partially rely, conduct a review of the quality of a sample of individual credits. In those instances where the supervisory analysis agrees with the internal analysis conducted by the bank, a higher degree of dependence can be placed on the use of such internal reviews for assessing the overall quality of the credit portfolio and the adequacy of provisions and reserves. Supervisors or external auditors should also assess the quality of a bank’s own internal validation process where internal risk ratings and/or credit risk models are used. Supervisors should also review the results of any independent internal reviews of the credit-granting and credit administration functions. Supervisors may also make use of any reviews conducted by the bank’s internal and external auditors, where available.
Supervisors should take particular note of whether bank management recognises problem exposures at an early stage and takes the appropriate actions. Supervisors should monitor trends within a bank’s overall credit portfolio and discuss with senior management any marked deterioration. Supervisors should also assess whether the capital of the bank, in addition to its provisions and reserves, is adequate considering the level of credit risk identified and inherent in the bank’s various on- and off-balance sheet activities.
In reviewing the adequacy of the credit risk management process, home country supervisors should also determine that the process is effective across business lines, subsidiaries and national boundaries. It is important that supervisors evaluate the credit risk management system not only at the level of individual businesses or legal entities but also across the wide spectrum of activities and subsidiaries within the consolidated banking group.
After the credit risk management process is evaluated, the supervisors should address with management any weaknesses detected in the system, excess concentrations, the classification of problem exposures and the estimation of any additional provisions and the effect on the bank’s profitability of any suspension of interest accruals. In those instances where supervisors determine that a bank’s overall credit risk management system is not adequate or effective for that bank’s specific credit risk profile, they should ensure the bank takes the appropriate actions to improve promptly its credit risk management process.
Supervisors should consider setting prudential limits that would apply to all banks, irrespective of the quality of their credit risk management process. Supervisors set prudential limits to restrict bank exposures to single counterparties or groups of connected counterparties. Supervisors may also want to impose certain reporting requirements for credits of a particular type or exceeding certain established levels. The supervisor obtains information on a regular basis and in relevant detail or has access to information concerning the classification of exposures, collateral and other risk mitigants, provisions and write-offs, on country and transfer risk, on concentrations within a bank’s portfolio, including sectoral, geographical and currency exposures.7 Supervisors require banks to report (or acquire through other means) information on individual related-party transactions that are material.8
| 7 | See BCP40.42(6), BCP40.49(5), BCP40.44(4). |
| 8 | See BCP40.47(7). |
This module describes expectations to combat money laundering and terrorist financing.
This module describes expectations and practices relating to capital adequacy.
This module describes expectations for corporate governance.
This module describes expectations for credit risk and counterparty credit risk management.
This module describes expectations for external audit and sets out references related to public disclosure.
This module describes expectations for banks’ internal audit and compliance functions.
This module describes expectations for liquidity risk management.
This module sets out references related to market risk and interest rate risk.
This module describes expectations for the management of operational risk and operational resilience.
This module describes expectations for the management of problem assets and expected credit losses.
This module describes the application of proportionality in prudential regulation and supervision.
This module describes expectations for risk management.
This module describes the nature and application of prudential supervision.