Credit risk is the risk that a borrower or counterparty fails to meet its obligations, and the risk that the value of a credit exposure falls because the probability of that failure has risen. It is the largest risk on the balance sheet of nearly every bank, the risk that the capital rules spend most of their pages on, and the risk whose mismeasurement has caused more bank failures than all the others combined. This is the Risk Library reference on the subject: what credit risk is and the six forms it takes, the credit lifecycle from underwriting to workout and the controls at each stage, how it is measured (ratings, probability of default, loss given default, exposure at default, expected loss and the portfolio metrics built on them), the accounting under CECL and IFRS 9, the capital frameworks as they stand in 2026, the regulatory guidance an auditor cites, the concentrations that are stressing portfolios now, how the credit risk review function and internal audit divide the work, and a worked example of a portfolio credit risk audit at an illustrative nine-billion-dollar bank.
It is the companion to three engagement-level guides: how to audit credit risk (the program), the underwriting process audit (origination) and PD, LGD and EAD explained (the parameters). This guide is the reference they assume.
In this guide
- What credit risk is: six forms of one risk
- The credit lifecycle and the control at each stage
- Risk ratings: the measure everything else depends on
- PD, LGD, EAD and expected loss
- Portfolio measures: concentration, vintage, migration
- Accounting: CECL and IFRS 9
- Capital: standardised, IRB and the 2026 state of play
- Regulatory guidance an auditor should be able to cite
- Where the risk is now: CRE, leveraged lending, non-banks, consumer
- Credit risk review, the second line and internal audit
- Worked example: Lakeshore Bancorp’s FY27 portfolio credit risk audit
- Frequently asked questions
- Related guides
What credit risk is: six forms of one risk
The Basel Committee’s definition is the potential that a bank borrower or counterparty will fail to meet its obligations in accordance with agreed terms. Everything in credit risk management elaborates that sentence, and the elaboration starts with recognising that the one risk takes six forms, each with its own measurement and controls.
| Form | What it is | Where it lives | How it is measured | The control that matters most |
|---|---|---|---|---|
| Default risk | The borrower does not pay | Every loan, bond and receivable | Probability of default; delinquency; non-accrual | Underwriting and ongoing monitoring |
| Migration (downgrade) risk | The borrower’s credit quality falls, reducing the value or raising the required reserve and capital before any default | Rated portfolios; fair-valued credit | Rating transition matrices; spread changes | Timely, accurate risk rating |
| Concentration risk | Losses correlate because exposures share a borrower, industry, geography, collateral type or product | Commercial real estate, single large borrowers, sector lending | Share of capital; Herfindahl index; stress loss by segment | Concentration limits tied to capital |
| Counterparty credit risk | A derivatives or securities-financing counterparty defaults while the contract has positive value | Trading and treasury books | Current and potential future exposure; CVA | Collateral, netting, margining (Archegos was a counterparty failure) |
| Settlement risk | The bank delivers its side of a transaction and the counterparty fails to deliver theirs | FX and securities settlement | Exposure by settlement window | Payment-versus-payment and delivery-versus-payment mechanisms |
| Country and transfer risk | A sovereign event prevents payment regardless of the borrower’s condition | Cross-border lending | Country limits; sovereign ratings | Country risk management program |
Two boundaries matter for scoping. Credit risk and interest rate risk interact through floating-rate loans, where a rate rise raises the borrower’s debt service and therefore the probability of default; the interest rate risk pillar covers the rate side, and a joint scenario belongs in both frameworks. Credit risk and liquidity risk interact through the funding of a deteriorating portfolio and through the pledgeability of loans as collateral; the liquidity risk pillar covers that side. Operational failures in the credit process (a lost lien, a mis-keyed covenant) are operational risk events with credit consequences, and the taxonomy should say which bucket they report in, a question the risk taxonomy guide addresses.
The credit lifecycle and the control at each stage
Credit risk is managed through a lifecycle, and the lifecycle is the natural structure for the universe of credit audits, each stage being an auditable process with its own controls, systems and typical failures. The table gives the stages, the question each answers, the controls, and the failure that most often appears in examinations and audits.
| Stage | Question | Key controls | Typical failure |
|---|---|---|---|
| Strategy and appetite | What will we lend, to whom, how much, at what price? | Board-approved credit policy; appetite with concentration limits; product programs; pricing models | Growth targets set before the appetite; exceptions become the norm |
| Origination and underwriting | Should we make this loan? | Underwriting standards; financial analysis; collateral valuation; approval authorities; exception tracking | Boilerplate mitigants; approvals split to stay under authority; appraisals missing; see the underwriting audit |
| Documentation and closing | Do we have the legal right to be repaid and to take the collateral? | Document checklists; lien perfection; covenant loading; funding controls | Unperfected liens; covenants not loaded into the monitoring system |
| Risk rating | How likely is this borrower to default and how much would we lose? | Rating methodology; dual ratings; independent review; timely re-rating on triggers | Stale ratings; ratings that lag delinquency; grade inflation before year-end |
| Monitoring and servicing | Is the borrower still the borrower we underwrote? | Financial statement collection; covenant testing; annual reviews; early-warning indicators; collateral re-valuation | Covenants untested; statements not collected; waivers granted without authority |
| Problem loan management | What do we do when it goes wrong? | Watch list; criticised and classified asset reporting; transfer to workout; non-accrual and charge-off policies | Loans not moved to non-accrual on time; workout plans without milestones |
| Allowance and reporting | What will we lose, and have we reserved for it? | CECL or IFRS 9 methodology; model governance; qualitative overlays; board reporting | Overlays that absorb model output; segmentation that hides a deteriorating pool |
| Portfolio management | Is the whole portfolio within appetite? | Concentration reporting; stress testing; limit monitoring; capital allocation | Concentrations measured by one dimension only; stress tests not tied to limits |
Risk ratings: the measure everything else depends on
The risk rating assigned to each commercial borrower is the most consequential number in a bank’s credit process. It drives the allowance, the capital calculation under advanced approaches, the pricing, the monitoring frequency, the approval authority, the watch list and the regulatory classification. If the rating is wrong, every downstream measure is wrong in the same direction, and a bank can report a clean portfolio while deterioration spreads unrecorded; the pattern recurs in every credit cycle. The OCC’s guidance on rating credit risk expects a rating system that is accurate, timely, consistent across the bank, independently validated and integrated with the other credit processes, and the two-dimensional system that most mid-sized and large banks use (an obligor rating for probability of default and a facility rating for loss given default) is the structure examiners expect.
| Rating category | Regulatory classification | Typical two-dimensional grade | What it means | Consequence |
|---|---|---|---|---|
| Pass | Pass | Obligor 1 to 6 on a 10-point scale | The borrower is expected to perform; well-defined weaknesses are absent | Standard monitoring; pooled allowance |
| Pass / watch | Pass (internal watch) | 7 | Potential weakness that warrants attention but does not yet expose the bank to risk sufficient to criticise | Enhanced monitoring; quarterly review |
| Special mention | Criticised | 8 | Potential weaknesses that deserve management’s close attention; if uncorrected, may result in deterioration of repayment prospects | Criticised asset reporting; action plan |
| Substandard | Classified | 9 | Inadequately protected by the current sound worth and paying capacity of the obligor or the collateral; well-defined weakness; distinct possibility of loss | Classified reporting; usually non-accrual if payment in full is doubtful; individual assessment |
| Doubtful | Classified | 10 | All the weaknesses of substandard with the added characteristic that collection in full is highly questionable | Non-accrual; partial charge-off likely |
| Loss | Classified | — | Uncollectible and of such little value that continuance as a bankable asset is not warranted | Charge-off |
The audit tests for ratings are well established and the how to audit credit risk program sets them out: a sample of borrowers re-rated by the audit team or the credit risk review function against the methodology, with a tolerance for one-notch differences and a finding threshold for two-notch or category differences; a test of timeliness (how long after a trigger event did the rating change); a test of consistency across lending units; and a look at the distribution over time, because a rating distribution that does not move while delinquencies rise is the signature of a lagging system. The underwriting audit at Lakeshore found recorded exceptions at 14 per cent of files against 23 per cent found by audit, which is the same phenomenon at origination.
PD, LGD, EAD and expected loss
The quantitative language of credit risk is three parameters and their product. Probability of default (PD) is the likelihood the borrower defaults within a horizon, usually one year. Loss given default (LGD) is the share of the exposure lost if default occurs, after recoveries from collateral and guarantees, net of workout costs. Exposure at default (EAD) is the amount outstanding at the time of default, including the drawn share of undrawn commitments. Expected loss is PD multiplied by LGD multiplied by EAD, and it is the quantity the allowance (under a lifetime horizon) and the capital rules (under the IRB approaches) are built on. The PD, LGD and EAD guide explains the estimation methods; the table shows what each parameter looks like in practice and where the estimates go wrong.
| Parameter | Typical sources of the estimate | Illustrative values | Where estimates go wrong | Audit test |
|---|---|---|---|---|
| Probability of default | Internal rating transition history; external ratings and default studies; scorecards for retail; through-the-cycle versus point-in-time calibration | Pass-rated middle-market commercial: 0.5% to 2%; special mention 5% to 10%; substandard 15% to 30% (one year) | Too little default history; calibration to a benign period; ratings that lag | Back-test realised defaults by grade against PD; test calibration period |
| Loss given default | Workout history by collateral type; appraisal haircuts; recovery timing and cost | Owner-occupied CRE 20% to 35%; unsecured commercial 50% to 70%; residential mortgage 10% to 30% depending on LTV | Recoveries measured gross of cost; collateral values from origination; downturn LGD ignored | Reperform LGD for a sample of resolved defaults; compare to assumptions |
| Exposure at default | Drawn balance plus credit conversion factor on undrawn commitments | Term loan: balance; revolving line: balance plus 50% to 75% of undrawn | Undrawn commitments ignored; draws before default not studied | Test the conversion factor against the bank’s own pre-default draw experience |
| Expected loss | PD × LGD × EAD | A 10 million dollar substandard CRE loan: 20% × 30% × 10m = 600,000 one-year expected loss | Compounding of three optimistic estimates | Compare expected loss to the allowance and to realised losses by segment |
Unexpected loss, the variability of loss around the expectation, is what capital is for; expected loss is what the allowance is for. The two frameworks are built on the same parameters and must be consistent, and an audit that finds the allowance model using one PD and the capital model another for the same portfolio has found a governance gap even if each number is defensible on its own.
Portfolio measures: concentration, vintage, migration
Loan-level measures aggregate into portfolio measures, and the portfolio measures are where the board’s appetite and the regulator’s concern are expressed. The table lists the measures a mid-sized bank reports, what each shows, and the threshold or benchmark that gives it meaning.
| Measure | What it shows | Benchmark or threshold | Common reporting weakness |
|---|---|---|---|
| CRE concentration (CRE loans as a share of total risk-based capital) | Exposure to the asset class behind most US bank failures | The 2006 interagency guidance: construction and land development at or above 100% of capital, or total CRE at or above 300% with 50% growth over 36 months, triggers heightened supervisory analysis | Owner-occupied CRE excluded by definition but included in the risk analysis inconsistently |
| Single-borrower and group exposure | Largest exposures as a share of capital | Legal lending limits (15% of capital unsecured for national banks); internal house limits lower | Related borrowers not aggregated; the Lakeshore example found 7.4 million split as three loans under a 3 million authority |
| Industry and geography concentration | Correlated exposure | Internal limits as a share of capital; stress loss by segment | Industry codes stale or defaulted |
| Criticised and classified assets as a share of capital | The size of the problem book | Classified assets above 25% to 50% of capital draw supervisory attention | Measured at period-end only; trend masked by charge-offs |
| Delinquency and non-performing loans | Current performance | Peer comparison by product; NPL ratio by segment | Technical delinquencies mixed with real ones; modifications hiding delinquency |
| Vintage analysis | Performance of loans by origination cohort | Later vintages should not underperform earlier ones at the same age | Rarely produced for commercial portfolios |
| Rating migration | Net upgrades and downgrades by period | Migration should lead delinquency, not follow it | Reported without the dollar volume behind it |
| Allowance coverage | Allowance as a share of loans and of non-performing loans | Peer range by portfolio mix; direction should track the credit cycle | Coverage held stable by overlay adjustments |
| Exceptions to policy | Underwriting discipline | Exception rate by product and approver; trend | Exceptions recorded by the originator |
Continuous monitoring of these measures is the natural bridge between credit audits: the key risk indicator program guide covers the mechanics and the KRI tables give example thresholds for credit risk among the other risk types.
Accounting: CECL and IFRS 9
Since 2020 for US SEC filers and 2023 for smaller and private institutions, the allowance for credit losses under the Current Expected Credit Loss standard (ASC 326) is a lifetime expected loss estimate recognised at origination, replacing the incurred loss model that reserved only when a loss was probable. Internationally, IFRS 9 (effective 2018) uses a three-stage model: twelve-month expected loss for performing exposures (stage 1), lifetime expected loss for exposures whose credit risk has increased significantly (stage 2) and lifetime expected loss for credit-impaired exposures (stage 3). Both standards require forward-looking information, reasonable and supportable forecasts, and management judgment, and both have moved the allowance from an accounting exercise to a model governance problem.
| Element | CECL (ASC 326) | IFRS 9 |
|---|---|---|
| Horizon | Lifetime from day one for all in-scope assets | Twelve months (stage 1) moving to lifetime on significant increase in credit risk (stages 2 and 3) |
| Methods permitted | Not prescribed: discounted cash flow, probability-of-default, loss rate, vintage, roll rate, WARM | Not prescribed; PD × LGD × EAD approaches dominate |
| Forecast period | Reasonable and supportable forecast, then reversion to historical loss | Forward-looking, multiple scenarios weighted by probability |
| Qualitative adjustments | Permitted and common (“Q-factors”); a frequent audit finding when they dominate the result | Overlays and post-model adjustments; same audit concern |
| Effective | 2020 (SEC filers), 2023 (others) | 2018 |
| Audit focus | Segmentation, data, model governance, overlay governance, documentation of judgment, board reporting | Stage transfer criteria, scenario weights, overlay governance |
The audit of the allowance is often shared between the external auditor (who opines on the financial statements) and internal audit (who tests the process and the controls), and the two should coordinate rather than duplicate. Internal audit’s distinctive contribution is the controls over data and segmentation, the governance over qualitative overlays, and the consistency between the allowance parameters and the parameters used in risk rating, stress testing and capital.
Capital: standardised, IRB and the 2026 state of play
Credit risk consumes most of a bank’s risk-weighted assets, and the capital rules for it are in transition in 2026. The Basel III standardised approach assigns risk weights by exposure class (sovereign, bank, corporate, retail, residential and commercial real estate, defaulted) with greater granularity in the final (2017) version, including loan-to-value-based weights for real estate and a due diligence requirement where external ratings are used. The internal ratings-based approaches let banks use their own PD (foundation IRB) or PD, LGD and EAD (advanced IRB) estimates, subject to supervisory approval, floors on the parameters and, in the final framework, an output floor of 72.5 per cent of the standardised calculation, phasing in through 2028 in the jurisdictions that have implemented it. The European Union implemented the final credit risk framework from 1 January 2025; the United Kingdom from 1 January 2027; the United States proposed its version in July 2023, withdrew it after the comment period, and published a new consultation in March 2026, so as of this guide US banks remain on the 2013 rules with the advanced approaches for the largest firms.
For an auditor the capital question is a data and classification question: are exposures mapped to the correct class, are collateral and guarantees recognised only where the rules allow, are defaulted exposures identified consistently with the accounting and the ratings, and does the regulatory reporting reconcile to the general ledger and to the credit systems. The what regulators expect guide describes how examiners sequence a capital review.
Regulatory guidance an auditor should be able to cite
Credit risk has the deepest body of supervisory guidance of any risk, and an audit report that cites the right document carries more weight with management and the examiner. The table lists the US guidance a credit auditor uses most, with the point each makes that becomes a criterion.
| Guidance | Issuer and year | What it establishes | Audit use |
|---|---|---|---|
| Interagency Guidance on Credit Risk Review Systems | Federal Reserve, FDIC, OCC, NCUA, 2020 | Expectations for an independent credit risk review function: independence, scope, depth, frequency, reporting to the board | Criteria for auditing the credit review function and for deciding reliance on it |
| Concentrations in Commercial Real Estate Lending, Sound Risk Management Practices | Interagency, 2006 | The 100 per cent and 300 per cent of capital thresholds; expectations for concentration management, stress testing and capital | Criteria for concentration audits |
| Policy Statement on Prudent Commercial Real Estate Loan Accommodations and Workouts | Interagency, 2023 | How to classify, rate and account for workouts and accommodations; replaces the 2009 statement | Criteria for problem loan and workout audits |
| Interagency Guidance on Leveraged Lending | Federal Reserve, FDIC, OCC, 2013 | Underwriting standards, leverage thresholds, pipeline management and risk rating for leveraged transactions | Criteria for leveraged lending audits at banks with that business |
| Allowance for Credit Losses guidance and Comptroller’s Handbook booklets | Interagency and OCC, 2020 onward | CECL implementation expectations, methodology, qualitative factors, governance | Criteria for allowance process audits |
| Rating Credit Risk (Comptroller’s Handbook) | OCC | Characteristics of a sound rating system; two-dimensional ratings; the regulatory classification definitions | Criteria for rating accuracy audits |
| Uniform Retail Credit Classification and Account Management Policy | FFIEC, 2000 | Charge-off and classification timeframes for retail credit (for example 120 days for closed-end, 180 for open-end) | Criteria for consumer portfolio audits |
| Shared National Credit Program | Interagency, annual | Supervisory review of large syndicated credits; results published annually | Benchmark for the bank’s ratings on shared credits |
Where the risk is now: CRE, leveraged lending, non-banks, consumer
A reference guide should say where the risk is concentrated at the time of writing, because an audit plan that spreads hours evenly across the portfolio is a plan that has not read the news. Four themes dominate supervisory attention in 2026.
Commercial real estate, and office in particular, has been the headline since 2023: higher rates raised debt service on floating-rate and maturing loans, remote work reduced office demand, and valuations fell, with a wave of maturities through 2026 and 2027 that borrowers cannot refinance at original terms. The 2023 interagency workout statement was issued for this cycle. The audit questions are concentration against the 2006 thresholds, the currency of appraisals, the realism of debt service coverage calculations at refinancing rates, the identification of maturity risk, and whether accommodations are being rated and accounted for as the statement requires.
Leveraged lending and the migration of leveraged credit to private credit funds has changed the shape of bank exposure: banks hold less of the risk directly and more indirectly, through loans to the funds, business development companies and other non-bank financial institutions that hold it. Regulators have been adding granularity to the reporting of loans to non-bank financial institutions, and the audit question is whether the bank understands what sits behind its lending to funds and whether the 2013 guidance is applied to the leveraged transactions it still originates.
Consumer credit normalised after the pandemic-era lows: credit card and auto delinquencies rose through 2023 and 2024 and remained elevated, with lower-income borrowers and later vintages performing worse. The audit questions are vintage performance, scorecard drift (scores calibrated on 2020 to 2021 behaviour), and the allowance segmentation that may pool a deteriorating vintage with a healthy one.
Counterparty and settlement risk in the trading book remains the risk that surprises: the lessons of Archegos in 2021 (static margin on concentrated equity swaps) are in the market risk pillar, and the audit should confirm that counterparty exposure is aggregated across products and legal entities and that margin responds to concentration.
Credit risk review, the second line and internal audit
Credit risk is unusual in having a dedicated independent review function, the credit risk review (or loan review) function, whose job is to test the accuracy of risk ratings, the quality of underwriting and the adequacy of problem loan identification on a sample basis throughout the year. The 2020 interagency guidance sets expectations for it: independence from the lending function, qualified staff, a scope and depth that covers the material portfolios, and reporting to the board or a committee. Where it sits in the three lines varies (sometimes in the second line, sometimes as a separate function reporting to the audit committee), and the relationship with internal audit should be deliberate rather than accidental.
| Activity | Credit risk review | Internal audit | Reliance and coordination |
|---|---|---|---|
| Rating accuracy | Primary: re-rates a sample continuously | Tests the review function and re-rates a small sample independently | Audit may rely on review’s results after testing its independence, scope, methodology and a sample of its work |
| Underwriting quality | Primary at the file level | Process and control audit of origination; see the underwriting audit | Coordinate samples to avoid duplication |
| Problem loan identification | Primary: watch list and classification accuracy | Tests the process, non-accrual timing, workout governance | Share findings; audit escalates systemic issues |
| Allowance | May test inputs | Audits the process, model governance, overlays, data | Audit owns this; external audit coordinates |
| Concentrations and portfolio management | Usually not in scope | Audits reporting, limits, stress testing | Audit owns this |
| Credit administration (documentation, liens, covenants) | Sometimes in scope | Audits controls and tests samples | Agree scope annually |
| Credit models (PD, LGD, scorecards, CECL) | Not in scope | Audits model risk management; see the model risk audit guide | Audit owns this with model validation |
The reliance decision is the one examiners probe. Internal audit can reduce its own rating testing where the review function is independent, competent and its work has been tested, and it must document that conclusion annually; it cannot rely where review reports to the chief credit officer, where its scope excludes the portfolios that matter, or where its sample sizes are too small to support a conclusion. The auditing ERM guide covers reliance mechanics generally, and the bank audit universe shows credit risk review as its own auditable entity.
Worked example: Lakeshore Bancorp’s FY27 portfolio credit risk audit
Lakeshore Bancorp is the illustrative nine-billion-dollar public regional bank used across this site, with a twenty-two person audit function. Its FY26 underwriting audit was rated Needs Improvement: recorded underwriting exceptions of 14 per cent against 23 per cent found by audit, 41 per cent of mitigants boilerplate, seven loans above supervisory loan-to-value limits unflagged, a 7.4-million-dollar borrower group approved as three loans under a 3-million-dollar authority, and 31 per cent of covenants not loaded into the monitoring system. The FY27 plan followed with a 600-hour portfolio credit risk management audit: ratings, problem loan identification, concentrations, the allowance process and the credit risk review function, with the FY26 findings as context.
Lakeshore’s loan book at the planning date was 6.2 billion dollars: 2.4 billion commercial real estate (of which 310 million office and 420 million construction), 1.9 billion commercial and industrial, 1.1 billion residential mortgage and 0.8 billion consumer and indirect auto. Total risk-based capital was 1.05 billion dollars, so non-owner-occupied CRE stood at 228 per cent of capital and construction at 40 per cent, below the 2006 thresholds but with CRE growth of 38 per cent over 36 months. Criticised assets were 4.1 per cent of loans and classified 2.2 per cent; the allowance was 1.18 per cent of loans.
| Area | Procedure and result | Finding |
|---|---|---|
| Rating accuracy | Audit re-rated 60 commercial borrowers selected by risk (all office CRE above 5 million, a random sample of pass-rated C&I, all special mention). Agreement within one notch on 49; two-notch or category differences on 11, all downgrades, including four office loans rated pass that audit rated special mention or substandard on refinancing-rate debt service coverage below 1.0x | High: ratings lag deterioration in office CRE |
| Rating timeliness | For 25 borrowers downgraded in the year, median time from trigger (covenant breach, delinquency, appraisal) to rating change was 94 days against a policy of 30 | Medium |
| Problem loan identification | Three loans totalling 19 million with payments more than 90 days past due remained on accrual for 40 to 70 days beyond policy; interest of 310,000 was reversed after audit raised it | Medium |
| Concentrations | CRE reporting omitted 140 million of loans to real estate funds classified as C&I; restated non-owner-occupied CRE was 241 per cent of capital. Growth of 38 per cent over 36 months approached the 50 per cent trigger; no stress test by property type had been run | High: concentration understated and unstressed |
| Allowance process | CECL model (loss-rate by segment with a two-year forecast) governed under the model risk policy; qualitative overlays of 11.2 million (15 per cent of the allowance) supported by a memo that did not quantify the factors; office CRE pooled with other non-owner-occupied CRE despite distinct performance | High: overlay governance and segmentation |
| Credit risk review function | Reports to the chief credit officer; covered 55 per cent of commercial exposure in the year; its re-ratings agreed with the line in 97 per cent of cases, against audit’s 82 per cent on the risk-selected sample | High: independence and effectiveness; reliance not supportable |
| Covenant monitoring (FY26 follow-up) | Covenant loading gap reduced from 31 per cent to 0.5 per cent; second-person check sequencing weakness remained (9 of 62); the quarterly completeness analytic is in place | Partially validated, per the FY26 issue validation |
The engagement was rated Needs Improvement with four High findings. Management agreed to re-rate the office CRE portfolio in full within sixty days, to run a CRE stress test by property type and refinancing scenario for the board’s next meeting, to split office into its own allowance segment, to document and quantify the qualitative overlays, and to move the credit risk review function’s reporting line to the audit committee with a scope covering 80 per cent of commercial exposure annually. The audit committee asked for quarterly reporting on office CRE until the re-rating and the stress test were complete, and internal audit added the criticised asset ratio, the office CRE debt service coverage distribution and the overlay share of the allowance to its continuous monitoring. Validation of the High findings followed the issue validation standard, with the FY26 covenant finding carried alongside.
Frequently asked questions
What is the difference between credit risk and counterparty credit risk?
Counterparty credit risk is credit risk on derivatives and securities financing transactions, where the exposure is not a fixed loan balance but the replacement cost of the contract, which changes with market prices and can be zero or positive on any day. It is measured with current exposure and potential future exposure, managed with netting, collateral and margining, and capitalised separately. Archegos in 2021 was a counterparty credit loss: the exposure grew with the share prices and the margin did not.
How are credit risk ratings and regulatory classifications related?
The bank’s internal rating scale maps to the regulatory classifications: pass, special mention (criticised), and substandard, doubtful and loss (classified). Examiners use the regulatory definitions when they review loans, and a bank whose internal ratings diverge from the definitions will have its loans reclassified in the examination report. Most banks use a ten-point obligor scale where grades 1 to 6 or 7 are pass, 8 is special mention, 9 substandard and 10 doubtful, with loss charged off rather than rated.
What does CECL change for an internal auditor?
The allowance became a lifetime forward-looking estimate built on models, forecasts and judgment, so the audit moved from testing a calculation to testing a model governance process: data and segmentation, methodology, forecast selection, the qualitative overlays and their documentation, and the consistency of the parameters with the rest of the credit framework. The external auditor opines on the number; internal audit tests the process that produces it and the controls around the judgments.
What are the CRE concentration thresholds?
The 2006 interagency guidance identifies institutions for heightened supervisory analysis when construction, land development and other land loans reach 100 per cent of total risk-based capital, or when total non-owner-occupied commercial real estate loans reach 300 per cent of capital and the CRE portfolio has grown 50 per cent or more over the prior 36 months. The thresholds are screening criteria, not limits, but a bank above them is expected to show concentration management, stress testing and capital planning commensurate with the exposure.
Can internal audit rely on the credit risk review function?
Partly, and only after testing it. The 2020 interagency guidance sets the expectations for the function’s independence, scope and reporting; internal audit can reduce its own rating testing where those expectations are met and its test of the function’s work supports the conclusion. Reliance is not supportable where the function reports to the lending side, where its coverage excludes material portfolios, or where its agreement rate with the line is implausibly high, as in the Lakeshore example.
How should credit stress testing connect to limits?
A stress test that reports a loss number without a consequence is a presentation, not a control. The appetite should state the stress loss the bank will accept as a share of capital under named scenarios, by segment where concentrations exist, and the concentration limits should be calibrated to the stress results. An audit that finds stress tests run and reported but no limit derived from them has found the gap.
What is the output floor in the Basel capital rules?
Under the final Basel III framework, a bank using internal models cannot report total risk-weighted assets below 72.5 per cent of what the standardised approaches would produce, phasing in through 2028 in the jurisdictions that have implemented it. It limits the capital benefit of internal ratings-based credit risk models. The United States has not implemented the final framework as of 2026; a new consultation was published in March 2026.
Where does the audit of credit risk sit in a bank’s universe?
Usually as several entities following the lifecycle: commercial underwriting, consumer underwriting, credit administration, risk rating and problem loans, the allowance, portfolio management and concentrations, and the credit risk review function, each on its own cycle with the highest-risk portfolios audited annually. The bank internal audit universe example shows the full set and the internal audit in banking guide the context.
Related guides
- How to Audit Credit Risk — the engagement program: scope, tests, samples and red flags
- Underwriting Process Audit — origination controls with the Lakeshore FY26 example
- PD, LGD and EAD Explained — estimating and auditing the three parameters
- Interest Rate Risk — the rate side of floating-rate credit and the 2024 Basel recalibration
- Liquidity Risk — funding a deteriorating portfolio and pledging loans as collateral
- Market Risk — counterparty credit risk in the trading book and the Archegos lesson
- How to Audit Model Risk Management — CECL models, scorecards and rating models under the model risk policy
- SR 11-7 and SR 26-2 — the model risk expectations behind the credit models
- Bank Internal Audit Universe Example — how the credit lifecycle maps to auditable entities
- Key Risk Indicator Program — continuous monitoring of the portfolio measures between audits
- Credit Risk category — every guide on the subject in one archive
Leave a Reply