Credit Policy, Governance and Lending Organization

Introduction

Credit creation is central to banking, but every loan exposes the institution to possible loss, liquidity pressure, concentration risk, legal disputes and reputational damage. A credit policy converts a bank’s strategy and risk appetite into enforceable lending rules. It defines whom the bank will finance, which products it will offer, how much risk it will accept, who may approve transactions and how decisions must be documented and monitored.

A sound policy does not eliminate risk. Instead, it supports deliberate, measurable and accountable risk-taking. It must balance commercial responsiveness with independent challenge, regulatory compliance and protection of depositors and shareholders. Because institutions differ in capital, funding, expertise and market position, there is no universally optimal credit policy. Each institution must design one consistent with its business model and applicable law.

Learning Objectives

After studying this chapter, students should be able to:

• explain the purpose and hierarchy of credit policies;
• design target-market and borrower-eligibility criteria;
• translate risk appetite into measurable credit limits;
• calculate and interpret borrower, group and sector concentrations;
• design delegated-authority and committee structures;
• apply segregation of duties across the lending life cycle;
• distinguish policy exceptions from approval escalation;
• evaluate internal controls, audit trails and board oversight; and
• assess the governance implications of automated and AI-assisted lending.

1. Credit Policy within the Governance Framework

A credit policy is a board-approved statement of the principles, boundaries and control requirements governing credit risk. It normally applies to loans, overdrafts, guarantees, letters of credit, leasing exposures, debt securities and other transactions that create counterparty credit exposure.

Credit governance usually follows a hierarchy:

Lower-level documents cannot authorize activities prohibited at a higher level. Procedures may explain how to obtain collateral valuations, for example, but cannot override a policy prohibition against lending to an ineligible industry.

1.1 Objectives of a credit policy

An effective policy should:

1. align lending with strategy and risk-bearing capacity;
2. define acceptable and unacceptable credit risk;
3. promote consistent decisions across branches and business units;
4. establish accountability and approval authority;
5. control individual and portfolio concentrations;
6. satisfy legal, regulatory and ethical obligations;
7. support early identification and resolution of deterioration; and
8. create reliable evidence for management, auditors and supervisors.

Policies must be sufficiently specific to guide decisions but not so rigid that they become substitutes for professional judgment. Excessive discretion produces inconsistent lending, while excessive prescription may encourage mechanical compliance without genuine risk analysis.

2. Designing the Scope and Market Boundaries

2.1 Target markets

The target-market section identifies the customers, industries, products and geographical areas the bank intends to serve. Its purpose is strategic as well as prudential: a bank should lend where it possesses adequate expertise, data, operational capacity and risk-management capability.

A target-market definition may specify:

• retail, small-business, corporate or institutional customers;
• permitted industries and excluded activities;
• countries, regions or branch territories;
• customer size, turnover or income bands;
• permitted currencies and products;
• acceptable purposes, such as working capital or home purchase;
• minimum risk-adjusted return expectations; and
• environmental, social or ethical restrictions.

A target market is not an automatic approval list. A borrower within the target market must still satisfy eligibility and underwriting requirements.

2.2 Eligibility criteria

Eligibility criteria are minimum conditions that must be satisfied before a full credit proposal can proceed. Common criteria include:

• legal capacity to borrow;
• satisfactory identity and beneficial-ownership verification;
• compliance with anti-money-laundering and sanctions requirements;
• acceptable credit history;
• evidence of stable and legitimate repayment capacity;
• minimum operating history for business borrowers;
• acceptable internal or external risk grade;
• permitted loan purpose;
• absence of prohibited conflicts of interest; and
• availability of required information and financial statements.

Eligibility should not be confused with creditworthiness. A company may be legally eligible to apply but still be declined because its cash flow is inadequate.

2.3 Prohibited and restricted lending

Prohibited lending is not permitted under stated circumstances. Examples may include illegal activities, sanctioned parties or transactions involving falsified information. Restricted lending may be allowed only under enhanced conditions, such as specialist review, senior approval or lower exposure limits.

Restrictions should identify the policy rationale, responsible approval level and required controls. Vague wording such as “avoid risky industries” is difficult to apply and audit.

3. Translating Risk Appetite into Credit Standards

A risk appetite statement describes the aggregate level and types of risk that the institution is willing to assume in pursuit of its objectives. Credit policy converts this high-level statement into limits, underwriting standards and monitoring triggers.

3.1 Quantitative and qualitative expressions

Quantitative measures may include:

• maximum non-performing loan ratio;
• expected or unexpected credit loss limits;
• minimum portfolio credit quality;
• single-borrower and connected-group limits;
• sector, country and product concentration limits;
• collateral loan-to-value limits; and
• minimum debt-service coverage ratios.

Qualitative expressions address risks that cannot be represented adequately by one number, including reputational sensitivity, underwriting discipline, management competence and the reliability of borrower information.

A simplified one-period expected credit loss measure is:

where:

• EL = expected loss in currency units over the stated period;
• PD = probability of default during that period, expressed as a decimal;
• LGD = proportion of exposure expected to be lost if default occurs; and
• EAD = expected exposure at the time of default, in currency units.

The inputs must refer to compatible periods and definitions. This simplified relationship does not by itself capture discounting, multiple future scenarios or detailed accounting-standard requirements.

3.2 Limits, triggers and targets

These concepts should be distinguished:

• Limit: a boundary that must not be exceeded without specifically authorized action.
• Trigger: an early-warning threshold requiring investigation or escalation.
• Target: a desired operating level rather than a hard boundary.

For example, a bank may set a target manufacturing concentration of 16%, an escalation trigger of 18% and a hard limit of 20% of total portfolio exposure. Treating all three as equivalent weakens governance.

4. Exposure Measurement and Concentration Limits

A limit is meaningful only when its numerator, denominator, measurement basis and timing are clearly defined. Policy should state whether exposure means outstanding balance, approved limit, committed amount, exposure at default or another measure. It should also state whether the measure is gross or net of eligible credit-risk mitigation.

4.1 Sector concentration

If policy defines a sector limit as a percentage of the total bank credit portfolio, the ratio is:

where:

• C_s = sector concentration ratio;
• E_s = exposure to sector s; and
• E_T = total bank credit portfolio exposure.

Both exposures must use the same measurement basis, reporting date and currency. A sector’s own subportfolio cannot be used as the denominator for a bank-wide sector concentration limit.

4.2 Single-borrower or connected-group limits

A policy or regulation may define a connected-group limit relative to eligible regulatory capital:

where E_g is exposure to the connected group and K is the defined eligible capital base. This ratio is conceptually different from a sector concentration ratio. The precise capital definition must follow the relevant jurisdiction’s rules.

Borrowers should be grouped where control or economic interdependence means that the financial distress of one is likely to affect the others. Failure to identify connected parties can conceal excessive risk.

4.3 Other exposure limits

Credit policies commonly establish limits by:

• borrower or connected group;
• industry and sub-industry;
• country or region;
• product and collateral type;
• currency and maturity;
• risk grade;
• unsecured exposure; and
• exceptions or covenant waivers.

Limits should be monitored both before approval and after drawdown. A compliant transaction may later contribute to a breach because exchange rates, credit conversion factors, portfolio size or borrower connections change.

5. Delegated Credit Authority

Delegated authority permits specified individuals or committees to approve credit within defined boundaries. It improves speed but must not transfer ultimate accountability away from the board and senior management.

An authority schedule should identify:

• maximum new and aggregate group exposure;
• permitted risk grades;
• maximum tenor;
• secured and unsecured limits;
• product and industry restrictions;
• authority to approve renewals, restructurings or write-offs;
• whether authority is individual or joint; and
• escalation requirements.

Authority should reflect competence, experience and independence—not merely organizational rank.

5.1 Core delegation principles

Aggregation: Related facilities and connected borrowers must be considered together. A large exposure must not be divided into smaller applications to fit a lower authority level.

No self-approval: A person who originates or benefits from a transaction should not independently approve it.

Lowest applicable authority: Where multiple restrictions apply, the most restrictive governs. An officer may have sufficient monetary authority but lack authority for the borrower’s risk grade or loan tenor.

Temporary delegation: Acting or substitute authority should be documented with start and end dates.

Revocation: Authority may be reduced or withdrawn following control failures, policy breaches or changes in role.

6. Approval Committees and Decision Quality

Credit committees combine expertise, independent challenge and collective accountability. Depending on the institution, committees may exist at branch, management, executive or board level.

A committee charter should specify membership, quorum, voting rules, conflicts-of-interest procedures, authority limits, meeting frequency and minute-taking requirements. Decisions should record approvals, declines, conditions, dissenting views and reasons.

Committee review should address at least:

• borrower and connected-party identification;
• repayment capacity and downside sensitivity;
• facility purpose, structure and tenor;
• collateral quality and enforceability;
• risk rating and pricing;
• portfolio and concentration effects;
• covenant and monitoring arrangements; and
• policy compliance or requested exceptions.

Consensus can improve judgment, but it may also create groupthink or dilute personal responsibility. Effective chairs invite challenge, ensure relevant information is considered and prevent senior personalities from dominating the decision.

7. Lending Organization and Segregation of Duties

Segregation of duties reduces the possibility that one person can originate, approve, document, disburse and conceal a problematic loan. It is a central defense against error, fraud and conflicts of interest.

Figure: Segregation of duties across the credit life cycle.

7.1 Three lines of accountability

A common governance model assigns:

1. First line: business and operations own risks and execute controls;
2. Second line: independent risk and compliance functions establish frameworks, challenge decisions and monitor adherence; and
3. Third line: internal audit independently assesses governance, risk management and controls.

The model does not remove management’s responsibility. Internal audit should not design or operate controls that it later audits.

8. Policy Exceptions and Escalation

An exception occurs when a proposed or existing exposure does not satisfy an established policy requirement. Examples include inadequate financial information, a maturity beyond the policy standard or collateral outside normal criteria.

An escalation is different. A transaction may comply with policy but require referral because it exceeds an officer’s delegated authority. Escalation does not convert non-compliance into compliance.

An exception process should require:

• precise identification of the breached requirement;
• commercial rationale;
• risk assessment and compensating controls;
• approval by an authority independent of the originator;
• expiry or review date;
• inclusion in an exception register; and
• reporting of trends to senior management and the board.

Certain rules should be non-waivable, particularly legal prohibitions, sanctions requirements and limits that policy or regulation expressly defines as absolute. Repeated exceptions may indicate that the policy is unrealistic, staff discipline is weak or the institution’s risk appetite is being exceeded.

9. Internal Controls and Audit Trails

Internal controls provide reasonable—not absolute—assurance that lending objectives will be achieved.

Before disbursement, operations should verify that approval conditions are fulfilled, documents are executed, security is perfected where required, insurance is effective and system limits match the approval. This verification should be evidenced rather than assumed.

An audit trail should establish:

• who created, reviewed and approved the proposal;
• which data and document versions were used;
• date and time of each action;
• changes to risk ratings, limits or terms;
• approval conditions and evidence of fulfilment;
• system overrides and reasons;
• disbursements, repayments and amendments; and
• subsequent monitoring and exception activity.

Electronic records should be access-controlled, tamper-evident, retained for the required period and recoverable after operational disruption.

10. Board and Senior-Management Oversight

The board approves the risk appetite and material credit policies, oversees senior management and ensures that the institution maintains sufficient resources and controls. It should not normally perform routine loan underwriting, although a board credit committee may approve large or sensitive exposures under its charter.

Useful board reporting includes:

• portfolio growth and composition;
• concentrations against limits and triggers;
• risk-grade migration;
• arrears, defaults and non-performing exposures;
• expected losses and provisions;
• large exposures and related-party lending;
• policy exceptions and overrides;
• covenant breaches and restructurings;
• stress-test results; and
• overdue reviews or collateral valuations.

Reports should show trends, causes and proposed actions rather than presenting raw numbers alone. Data quality is itself a governance concern: inaccurate connected-party, sector or collateral data can make apparently precise reports misleading.

Related-party lending requires particularly strong governance because personal or institutional relationships may distort judgment. Applicable law may require special approval, disclosure or arm’s-length terms.

11. Detailed Illustrative Case: Northbridge Bank

Background

Northbridge Bank is a fictional mid-sized commercial bank. Its policy measures both sector and total portfolio exposure using exposure at default (EAD) in millions of currency units. Immediately before a proposed facility:

• total bank credit portfolio EAD is 950 million;
• manufacturing-sector EAD is 176 million;
• Atlas Industrial Group’s EAD is 24 million;
• eligible capital is 550 million; and
• Atlas requests a new five-year facility with EAD of 20 million.

The policy contains two separate limits:

1. Manufacturing-sector limit: pro forma manufacturing EAD must not exceed 20% of pro forma total bank credit portfolio EAD.
2. Connected-group limit: group EAD must not exceed 8% of eligible capital.

The denominators are deliberately different. The manufacturing limit uses total bank portfolio EAD; the Atlas connected-group limit uses eligible capital.

Problem

Management must determine whether the requested facility complies with both limits and whether the correct approving authority is involved. Policy also requires aggregate connected-group exposure above 35 million to be approved by the board credit committee.

Analysis

If the full 20 million is approved, both manufacturing EAD and total portfolio EAD increase by 20 million:

The result is approximately 20.21%, which exceeds the 20% sector limit by approximately 0.21 percentage points. It would be incorrect to divide Atlas exposure by manufacturing exposure and call the result the manufacturing-sector concentration. That would measure Atlas’s share of the manufacturing subportfolio, not manufacturing’s share of the bank portfolio.

The connected-group test is:

After the requested facility, Atlas exposure would be:

Atlas would be exactly at, but not above, the connected-group limit. Its remaining headroom would be zero.

To find the maximum additional facility x consistent with the sector limit, solve:

Provided the denominator is positive:

At 17.5 million, manufacturing EAD is 193.5 million and total portfolio EAD is 967.5 million:

Atlas group exposure would then be 41.5 million, equal to 7.55% of eligible capital when rounded to two decimal places:

Approach and solution

The relationship manager proposes reducing the facility to 17.5 million. Independent credit risk confirms cash-flow adequacy, performs a downside stress test and recommends financial covenants. Because Atlas’s aggregate exposure would be 41.5 million—above the 35 million board-committee threshold—the proposal is escalated to the board credit committee. This escalation is required by delegated authority; it is not a policy exception.

The committee approves 17.5 million subject to completion of security documentation, quarterly financial reporting and a prohibition on further exposure without a fresh concentration test.

Outcome

The revised transaction remains within both quantitative limits:

• manufacturing concentration: exactly 20.00%;
• Atlas connected-group exposure: 41.5 million, below the 44 million limit; and
• approval: granted by the authority required for aggregate exposure above 35 million.

Because the sector limit has no remaining headroom, subsequent changes in EAD could cause a breach. The portfolio must therefore be monitored closely, and the bank may choose to operate below the mathematical maximum by reducing the facility further.

Learning points

• Every limit must specify its denominator and exposure basis.
• Pro forma testing should include the proposed exposure in all affected portfolio totals.
• A transaction may satisfy one limit while breaching another.
• Equality with a hard limit leaves no prudential buffer.
• Approval escalation is not the same as a policy exception.
• Connected exposures must be aggregated when authority and limits are tested.

12. Technology, Data and AI in Credit Governance

Loan-origination systems can enforce mandatory fields, authority limits, workflow separation and digital audit trails. Automated controls are especially valuable where transaction volumes are high. Their effectiveness, however, depends on accurate data, correct configuration and controlled user access.

Statistical models and artificial intelligence may support scoring, document analysis, fraud detection and early-warning systems. Governance should address:

• model validation and performance monitoring;
• data quality, privacy and lawful use;
• bias and unfair discrimination;
• explainability appropriate to the decision;
• human review and override controls;
• cybersecurity and third-party risk; and
• version control and change authorization.

A human override should not be an undocumented means of bypassing the model. Both positive and negative overrides should be recorded, justified and analysed for patterns. Conversely, human involvement does not automatically correct model bias; staff may introduce their own biases.

13. Challenges, Contemporary Developments and Best Practice

Credit policy operates in changing economic and regulatory conditions. Inflation, interest-rate volatility, climate-related risks, geopolitical disruptions and rapid digital lending can alter borrower resilience and portfolio correlations. Historical default experience may be unreliable when structural conditions change.

Climate and environmental risks may affect borrowers through physical damage, regulation, technology changes or shifts in consumer demand. These risks should be incorporated where material rather than treated solely as reputational concerns.

Best-practice policy management includes:

• annual review and interim review after major events;
• clear ownership and version control;
• consultation with business, risk, legal, compliance and operations;
• definitions consistent across systems and reports;
• back-testing of underwriting assumptions;
• independent monitoring of exceptions and overrides;
• stress testing of major concentrations;
• staff training and competency assessment; and
• board reporting focused on emerging risk and corrective action.

A policy can fail despite technically sound wording if incentives reward volume without regard to loan quality. Remuneration, performance measurement and organizational culture must therefore support prudent lending.

Chapter Summary

Credit policy is the principal mechanism through which a bank translates strategy and risk appetite into operational lending boundaries. It defines target markets, eligibility, underwriting standards, limits, approval authority, segregation of duties and monitoring requirements.

Exposure limits must state the applicable numerator, denominator, measurement basis and timing. Sector exposure is commonly measured against the total credit portfolio, whereas connected-group limits may be measured against an eligible capital base. Different limits must not be confused.

Delegated authority supports efficient decisions but requires aggregation, independence and escalation. Committees add expertise and challenge, while segregation of duties reduces fraud, error and conflicts of interest. Policy exceptions must be explicitly identified, justified, approved, time-bound and reported.

Internal controls and complete audit trails make credit decisions verifiable. The board remains responsible for approving risk appetite and material policy, overseeing concentrations and ensuring that management responds to deterioration. Technology and AI can strengthen lending processes, but they introduce data, bias, model and cybersecurity risks that require disciplined governance.

Key Terms

Credit policy: Board-approved principles and rules governing credit-risk-taking.

Risk appetite: The amount and type of risk an institution is willing to accept.

Target market: Customer, product, industry and geographical segments selected for lending.

Eligibility criteria: Minimum conditions required before an application can proceed.

Exposure at default (EAD): Expected amount exposed when a borrower defaults.

Concentration risk: Potential loss arising from excessive exposure to related risk factors.

Sector limit: Maximum permitted exposure to a defined economic sector.

Connected group: Borrowers linked through control or economic interdependence.

Eligible capital: Capital base defined for a particular policy or regulatory limit.

Delegated authority: Formally assigned power to approve specified credit decisions.

Credit committee: Collective body authorized to review or approve credit exposures.

Segregation of duties: Allocation of incompatible tasks to different persons or units.

Policy exception: Approved departure from a stated policy requirement.

Escalation: Referral of a decision to a higher authorized level.

Compensating control: Additional measure used to reduce risk when a normal control is absent.

Audit trail: Chronological evidence of actions, data, decisions and changes.

Override: Authorized departure from a model result or automated decision.

Board oversight: Direction and supervision exercised by the governing board.

Review Questions

Short Answer Questions

1. What is the principal purpose of a credit policy?
2. Distinguish borrower eligibility from creditworthiness.
3. Why must connected borrowers be aggregated?
4. What is the difference between a policy limit and an early-warning trigger?
5. Identify two characteristics of a reliable electronic audit trail.

Long Answer Questions

1. Explain how a bank translates its risk appetite into practical credit-policy requirements.
2. Discuss the design principles of an effective delegated-authority framework.
3. Evaluate the advantages and weaknesses of credit committee decision-making.
4. Explain how segregation of duties should operate across the lending life cycle.
5. Discuss the responsibilities of the board, senior management and internal audit in credit governance.

Analytical / Application Questions

1. A bank has total portfolio EAD of 800 million and agriculture EAD of 140 million. A proposed agriculture facility would add 25 million to both amounts. Calculate the pro forma sector concentration and assess it against a 20% limit.
2. Design an exception-approval process for a borrower requesting a tenor beyond the normal policy maximum. Identify the evidence, authority and monitoring required.
3. A lending model produces materially different approval rates for two customer groups. Recommend governance actions addressing validation, fairness, human review and auditability.

Multiple Choice Questions with Answers

Question 1

Which statement best describes the relationship between risk appetite and credit policy?

A. Credit policy replaces the need for a risk appetite statement.

B. Risk appetite is relevant only after a borrower defaults.

C. Credit policy translates risk appetite into lending rules and limits.

D. Risk appetite is a procedure manual for loan documentation.

Correct Answer: C. Credit policy translates risk appetite into lending rules and limits.

Question 2

A sector limit is defined as sector EAD divided by total bank portfolio EAD. Sector EAD is 180 million and total portfolio EAD is 900 million. What is the concentration ratio?

A. 5%

B. 20%

C. 25%

D. 80%

Correct Answer: B. 20%

Question 3

In the Northbridge case, why was Atlas exposure not divided by manufacturing EAD to test the manufacturing-sector limit?

A. Atlas had no manufacturing exposure.

B. Manufacturing EAD was measured in a different currency.

C. The proposed loan was unsecured.

D. The policy defined the sector denominator as total bank portfolio EAD.

Correct Answer: D. The policy defined the sector denominator as total bank portfolio EAD.

Question 4

Which action most clearly violates delegated-authority principles?

A. Dividing one exposure into smaller applications to remain within an officer's authority

B. Escalating a compliant large exposure to the board credit committee

C. Aggregating exposures to economically interdependent borrowers

D. Temporarily documenting an acting officer's authority

Correct Answer: A. Dividing one exposure into smaller applications to remain within an officer's authority

Question 5

Which arrangement provides the strongest segregation of duties?

A. The relationship manager originates, approves and disburses the loan.

B. Internal audit prepares the proposal and later audits it.

C. Business originates, independent risk reviews, and operations verifies conditions before disbursement.

D. The borrower selects the officer who will approve the facility.

Correct Answer: C. Business originates, independent risk reviews, and operations verifies conditions before disbursement.

Question 6

A facility complies with policy but exceeds a manager's monetary authority. Referral to a higher committee is best classified as:

A. A default

B. An escalation

C. A policy exception

D. A control failure

Correct Answer: B. An escalation

Question 7

Which item is essential in a policy-exception register?

A. Only the borrower's trading name

B. The exception, rationale, approval and review or expiry date

C. Only the relationship manager's sales target

D. A guarantee that the borrower cannot default

Correct Answer: B. The exception, rationale, approval and review or expiry date

Question 8

A system automatically blocks an approval above an officer's authority. This is primarily what type of control?

A. Preventive control

B. Detective control

C. Corrective control

D. External audit control

Correct Answer: A. Preventive control

Question 9

Under a three-lines model, which function should independently assess whether credit governance and controls are effective?

A. Loan origination

B. Credit sales

C. Internal audit

D. The borrower

Correct Answer: C. Internal audit

Question 10

Which practice is most appropriate for AI-assisted credit decisions?

A. Permit undocumented overrides whenever staff disagree with the model.

B. Assume human review automatically eliminates bias.

C. Avoid monitoring after the model is implemented.

D. Validate the model and record reasons for human overrides.

Correct Answer: D. Validate the model and record reasons for human overrides.