Credit Policy, Risk Appetite and Governance

Introduction

Credit is the principal earning asset of most banks and, simultaneously, their most significant source of financial risk. A loan decision converts uncertain future cash flows into a present commitment of institutional funds. The quality of that conversion depends not only on borrower analysis, but also on the rules, limits, authorities, controls and ethical standards within which lending occurs.

A sound credit policy translates the bank’s strategy and risk appetite into operational decisions. It specifies which customers and sectors the bank will serve, what risks it will accept, how exposures will be structured, who may approve them, how exceptions will be controlled and how deteriorating accounts will be managed. Governance ensures that these rules are applied consistently and that accountability is not diluted by commercial pressure.

This chapter examines the relationship among credit policy, risk appetite, exposure limits, delegation of authority and the three-lines governance model. It also considers regulatory compliance, ethical lending, technology-enabled controls and the tensions between growth, inclusion and prudential discipline.

Learning Objectives

After studying this chapter, the reader should be able to:

1. Explain the purpose, components and hierarchy of a bank’s credit policy.
2. Construct a practical risk-appetite statement for lending activities.
3. Calculate and interpret basic exposure and concentration measures.
4. Design exposure limits, delegation matrices and approval authorities.
5. Apply the three-lines model to credit governance and accountability.
6. Evaluate ethical, regulatory and technology-related issues in lending.
7. Diagnose governance weaknesses through an applied banking case.

1. Credit Policy as a Strategic Control System

A credit policy is an approved set of principles, standards and procedures governing the origination, assessment, approval, documentation, monitoring, restructuring and recovery of credit. It is more than an operations manual. It is a control system that connects the board’s strategy with individual lending decisions.

The policy normally operates within a hierarchy:

A policy should answer six fundamental questions:

• Where will the bank lend? Customers, industries, geographies, products and currencies.
• Why will it lend? Working capital, investment, trade, housing, consumption or other legitimate purposes.
• How much risk is acceptable? Quality thresholds, repayment capacity, collateral standards and concentration limits.
• Who may decide? Authority levels, committee requirements and escalation rules.
• How will risk be controlled? Covenants, documentation, monitoring, insurance, collateral and early-warning systems.
• What happens when performance deteriorates? Remedial management, restructuring, provisioning and recovery.

Core components of a credit policy

A comprehensive policy commonly includes:

1. Strategic scope: target markets, desired portfolio mix and strategic exclusions.
2. Eligibility standards: acceptable legal forms, ownership structures, industries and customer conduct.
3. Underwriting standards: minimum financial information, cash-flow analysis, repayment source and stress testing.
4. Security requirements: acceptable collateral, valuation, perfection, insurance and monitoring.
5. Pricing principles: risk-adjusted pricing, fees, commitment charges and compensation for capital usage.
6. Portfolio limits: borrower, connected-party, sector, geography, product, currency and maturity limits.
7. Approval and documentation: authority levels, independent review, conditions precedent and segregation of duties.
8. Monitoring: financial reporting, covenant testing, account conduct, collateral revaluation and watch-list procedures.
9. Problem-credit management: classification, provisioning, restructuring, write-off and recovery.
10. Exception governance: permissible deviations, approval, expiry, reporting and root-cause analysis.

A policy is effective only when it is measurable. For example, “lend prudently to small businesses” is aspirational; “no new unsecured exposure above a specified internal grade, unless approved by the credit committee” is operational.

2. Risk Appetite and the Credit Risk-Appetite Statement

Risk appetite is the aggregate level and types of risk a bank is willing to assume in pursuit of its objectives, within its capacity to absorb losses and remain viable. Risk capacity is the maximum risk the institution can bear, constrained by capital, liquidity, earnings, legal requirements and operational resilience. Appetite must be below capacity; otherwise an adverse event can threaten solvency or regulatory compliance.

A credit risk-appetite statement (RAS) should connect strategic ambition with measurable boundaries. It should contain:

• a qualitative statement of risk philosophy;
• quantitative limits and thresholds;
• portfolio-quality objectives;
• escalation triggers;
• management actions when limits are approached or breached;
• ownership, reporting frequency and review dates.

For example:

The bank seeks sustainable growth in diversified commercial and retail lending. It will accept measured borrower and sector risk where repayment is supported by reliable cash flow, but will not compromise underwriting independence, legal compliance, customer fairness or minimum capital requirements.

That statement becomes useful only when supported by metrics such as:

Appetite, tolerance and limits

These terms are related but distinct:

• Appetite: the broad amount and type of risk the bank intends to take.
• Tolerance: the permitted variation around a target or appetite level.
• Limit: a binding quantitative constraint applying to an exposure, portfolio or activity.
• Trigger: an early-warning point requiring management attention before a formal limit is breached.

A well-designed framework uses a cascade. The board may set a sector appetite; management sets a sector limit; business units receive sub-limits; individual officers receive approval authorities. This prevents a large number of individually acceptable decisions from creating an unacceptable aggregate exposure.

3. Exposure Measurement and Concentration Control

Exposure is not always equal to the amount originally disbursed. It may include funded loans, accrued interest, overdraft usage, undrawn commitments and potential future exposure from guarantees or derivatives. The applicable regulatory definition must be followed, while internal management information may use more conservative measures.

A simple funded exposure measure is:

where:

• E_f = net funded exposure;
• P = outstanding principal;
• I = eligible accrued interest included by policy;
• F = fees or other amounts treated as exposure;
• C = eligible credit risk mitigation or cash collateral.

The equation is a management simplification. It applies only when the components are measured consistently and when collateral recognition complies with policy and regulation. It must not be used to bypass legal large-exposure rules.

For an undrawn commitment, a credit conversion factor may be applied:

where EAD is exposure at default, D is the drawn amount, U is the undrawn commitment and α is the approved conversion factor between 0 and 1. The factor should reflect product behaviour, contractual terms, regulatory rules and validated evidence. It is not automatically equal to the probability that the commitment will be drawn.

A concentration ratio can be expressed as:

where CR_s is concentration to sector or group s, E_s is the relevant exposure and C_t is the chosen capital denominator, such as eligible regulatory capital or an internal capital base. The denominator must be defined in the policy and used consistently.

Worked example: sector concentration

A bank has eligible capital of 800 million currency units. Its construction-sector exposure is 136 million, including funded loans and the policy-recognised portion of commitments. Therefore:

If the board limit is 20% and the management trigger is 17.5%, the bank is below the formal limit but close to the trigger. The appropriate response is not necessarily immediate divestment; it may include enhanced monitoring, slower new origination, stress testing and review of pipeline commitments.

Important concentration dimensions

Concentration should be assessed by:

• single borrower and connected borrowers;
• industry and supply chain;
• geography and jurisdiction;
• product and collateral type;
• currency and interest-rate basis;
• maturity and refinancing date;
• common sponsor, parent or beneficial owner;
• climate, environmental and social dependency.

Correlation matters. Ten apparently separate borrowers may have the same commodity exposure, buyer, owner or regional market. A purely legal-entity view can therefore understate economic concentration.

4. Delegation of Authority and Approval Architecture

Delegation of authority (DoA) specifies who may approve a transaction, subject to conditions. It should reflect not only amount but also risk complexity. A low-value unsecured facility to a weak borrower may require more senior approval than a larger, well-secured facility to a highly rated customer.

A DoA matrix can include:

Amounts in a real matrix must be calibrated to the bank’s capital, portfolio size, regulatory requirements and staff competence. The matrix should address:

• new facilities, renewals, amendments and excesses;
• aggregate connected exposure rather than only the proposed tranche;
• internal risk grade and collateral quality;
• tenor, currency and product complexity;
• policy exceptions and restructuring;
• conflicts of interest and related-party transactions;
• quorum, voting, dissent and minutes;
• temporary authority and emergency approvals.

No employee should approve a facility where personal, family, investment or compensation interests could impair objective judgment. Business origination, credit approval, documentation, disbursement and monitoring should be appropriately segregated. Small institutions may use compensating controls, such as independent review and post-approval sampling, but convenience is not a justification for unmanaged conflicts.

5. The Three Lines Model in Credit Governance

The three-lines model clarifies responsibilities without implying that only one function owns risk.

First line: business and operational management

Relationship managers and business units own the risks created by their activities. Their duties include accurate customer information, responsible origination, covenant monitoring, escalation of warning signs and compliance with approved terms. Sales targets do not remove first-line accountability.

Second line: risk management and compliance

Risk functions develop frameworks, challenge proposals, monitor limits, validate risk grades, analyse portfolio trends and report breaches. Compliance interprets applicable laws and regulations, including customer protection, anti-money-laundering and sanctions requirements. The second line should be sufficiently independent from revenue generation.

Third line: internal audit

Internal audit provides independent assurance on governance, risk management and controls. It assesses whether the first and second lines are designed and operating effectively. Audit should not approve individual loans or own controls that it later evaluates.

The board and senior management remain accountable for the overall system. External auditors, supervisors and rating agencies are important external assurance or oversight participants, but they do not replace internal ownership.

6. Regulatory Compliance and Ethical Lending

Credit governance must comply with the laws and supervisory standards of the relevant jurisdiction. Common requirements include capital adequacy, large-exposure limits, connected-party lending, asset classification, provisioning, collateral valuation, consumer protection, data protection, anti-money-laundering controls and sanctions screening. Because rules differ across jurisdictions and change over time, a bank must maintain a regulatory inventory and obtain qualified legal and compliance interpretation rather than rely on generic policy language.

Responsible and ethical lending

Ethical lending extends beyond formal legality. It requires that the bank:

• assess affordability rather than merely collateral value;
• explain pricing, fees, risks and obligations clearly;
• avoid discriminatory decisions and unjustified exclusion;
• protect customer data and obtain lawful consent;
• avoid coercive sales and unsuitable refinancing;
• identify beneficial owners and suspicious activity;
• treat customers fairly during hardship and recovery;
• consider environmental and social effects where material.

Collateral is a secondary source of repayment. A loan should not be approved solely because assets appear available for enforcement. Valuations can fall, enforcement can be delayed and legal title can be defective. Similarly, a high credit score does not excuse inadequate purpose verification or affordability analysis.

Ethical tension often arises when financial inclusion conflicts with conventional documentation standards. The answer is not to abandon discipline, but to design proportionate controls: alternative evidence of income, smaller initial limits, transaction-based monitoring, financial education and graduated exposure. Inclusion must not become a pretext for predatory pricing or uncontrolled risk.

7. Monitoring, Exceptions and Escalation

Credit policy is a lifecycle framework. Approval is only one point in the relationship. Monitoring should cover repayment behaviour, financial performance, covenant compliance, collateral, account turnover, ownership changes, industry conditions and external information.

Early-warning indicators may include:

• repeated overdraft excesses;
• delayed financial statements;
• falling sales or margins;
• delayed payments to suppliers or government;
• adverse legal or media events;
• management turnover;
• unexplained related-party transactions;
• declining collateral values;
• rating migration or increased probability of default.

An exception is a documented departure from an approved rule, not an informal practice. Each exception should identify the rule, rationale, compensating control, approver, expiry date and monitoring requirement. Exception rates should be reported by product, officer, business unit and reason. Persistent exceptions may indicate unrealistic policy design, weak training or commercial pressure to circumvent controls.

Limit breaches require timely escalation. A robust protocol distinguishes:

1. Technical breach: caused by measurement, timing or reporting error.
2. Temporary breach: valid exposure exceeds a limit for a defined period.
3. Structural breach: portfolio composition or strategy is inconsistent with approved appetite.

Each category requires documented ownership, corrective action, deadline and board-level reporting where material.

8. Technology, Data and Artificial Intelligence

Credit governance increasingly depends on data architecture. A single exposure repository should link legal entities, beneficial owners, facilities, collateral, guarantees, commitments and risk grades. Data lineage is essential: decision-makers must know where a figure originated, when it was updated and whether it has been reconciled.

Automated decision systems can improve speed and consistency, but they introduce model risk. A bank should govern:

• data quality and representativeness;
• model purpose and approval;
• explainability and adverse-action communication;
• discrimination and proxy variables;
• performance drift and recalibration;
• override rates and override rationale;
• cybersecurity and privacy;
• human accountability for final decisions.

Artificial intelligence should support, not obscure, accountable credit judgment. A model that predicts default accurately but uses prohibited or discriminatory information remains unacceptable. Governance should include independent validation, challenger testing, stress analysis and a documented model inventory.

9. Applied Case: Meridian Bank’s Construction Concentration

The following is an illustrative case, created for educational purposes.

Background

Meridian Bank, a mid-sized commercial bank, pursued rapid growth in construction lending. Individual facilities were approved within delegated limits, and most were secured by property or receivables. The board’s formal sector limit was 20% of eligible capital.

Problem

After a property-market slowdown, several borrowers requested extensions. A review revealed that the bank had classified related developers separately, had not consistently included undrawn commitments, and had accepted outdated collateral valuations. The reported construction concentration was 17%; a connected-borrower analysis including commitments produced 22%.

Analysis

The problem was not simply excessive lending. It reflected weaknesses in governance:

• the exposure definition was ambiguous;
• beneficial ownership data were incomplete;
• business units controlled relationship information;
• the trigger below the formal limit was absent;
• valuation refresh requirements were inconsistently applied;
• remuneration rewarded volume more strongly than portfolio quality.

Stress testing showed that a 15% decline in collateral values and a two-year delay in project completion would materially increase loss-given-default and provisioning needs. The bank remained solvent, but its capital planning buffer narrowed.

Approach and solution

Management adopted a remediation programme:

1. Recalculate exposures using a board-approved definition including eligible undrawn commitments.
2. Establish a connected-party and beneficial-owner database.
3. Reduce the construction limit to a safer interim level and stop selected new originations.
4. Introduce a 17.5% management trigger and monthly reporting.
5. Require independent valuation refreshes for material property exposures.
6. Transfer vulnerable accounts to a specialist workout unit.
7. Rebalance incentives toward risk-adjusted returns and arrears performance.
8. Require credit committee approval for all exceptions and pipeline commitments.

Outcome

The bank reduced new construction commitments, improved data quality and created a more transparent portfolio view. Some growth targets were missed, but the board judged the cost acceptable because the revised framework reduced the probability of a disorderly concentration correction.

Learning points

The case demonstrates that governance failure can arise even when individual approvals appear compliant. Exposure aggregation, connectedness, forward commitments, data quality and incentives are as important as the nominal limit. A limit without a reliable measurement system is only an appearance of control.

10. Challenges and Limitations

Credit policy cannot eliminate uncertainty. Several limitations deserve attention:

• historical data may not represent future economic conditions;
• limits can create false comfort if correlations are ignored;
• collateral values are uncertain and procyclical;
• highly detailed rules can encourage box-ticking;
• excessive centralisation can slow legitimate lending;
• excessive delegation can weaken challenge;
• models may embed historical discrimination;
• regulatory compliance does not guarantee ethical conduct;
• stress tests depend on scenario design and management judgment.

Good governance therefore combines rules with informed challenge. The board should periodically ask whether limits remain suitable, whether incentives promote desired behaviour and whether the institution would recognise emerging risk before losses become obvious.

Best-Practice Design Principles

A mature credit governance framework should be:

1. Strategically aligned: policy supports the business model without subordinating prudence to growth.
2. Measurable: appetite, limits, triggers and exceptions have clear definitions.
3. Independent: approval and challenge are separated from origination where appropriate.
4. Forward-looking: stress testing and scenario analysis supplement historical performance.
5. Aggregated: exposures are consolidated by borrower, ownership, sector and risk driver.
6. Proportionate: controls reflect materiality and complexity.
7. Transparent: decisions, overrides, breaches and dissent are recorded.
8. Ethical: customer welfare, fairness and lawful purpose are part of credit quality.
9. Data-driven but accountable: technology informs judgment while responsibility remains human.
10. Reviewed: policy, limits and authorities change when strategy, regulation or risk conditions change.

Chapter Summary

Credit policy converts strategy and risk appetite into binding lending standards. A complete policy covers target markets, underwriting, security, pricing, limits, authority, monitoring, exceptions and problem-credit management. Risk appetite must be distinguished from capacity, tolerance, triggers and formal limits, and should be expressed through measurable indicators.

Exposure measurement must include relevant funded and contingent commitments and must consolidate connected borrowers and common risk drivers. Delegation matrices should reflect amount, quality, complexity and exceptions, while preserving segregation of duties. Under the three-lines model, business units own risk, risk and compliance challenge and monitor it, and internal audit provides independent assurance; the board remains ultimately accountable.

Regulatory compliance is necessary but not sufficient. Ethical lending requires affordability, fairness, transparency, privacy, responsible recovery and attention to environmental and social consequences. Technology can improve aggregation and decision quality, but model risk, bias, explainability and data governance require strong oversight. Effective credit governance is therefore a continuous system of disciplined judgment, measurement, challenge and accountability.

Key Terms

Credit policy: Approved principles and procedures governing lending activities.

Risk appetite: Amount and type of risk an institution is willing to accept.

Risk capacity: Maximum risk the institution can absorb while remaining viable.

Risk tolerance: Permitted variation around an appetite or target.

Exposure limit: Binding maximum for a borrower, portfolio or activity.

Concentration risk: Risk arising from excessive exposure to a common borrower or risk factor.

Connected borrowers: Entities linked by ownership, control, economic dependence or other relevant relationships.

Delegation of authority: Formal allocation of approval powers and conditions.

Exception: Approved departure from a credit rule or standard.

Trigger: Early-warning level requiring management attention.

Covenant: Contractual undertaking designed to control borrower behaviour or financial condition.

Three-lines model: Governance framework separating operational ownership, risk challenge and independent assurance.

Credit conversion factor: Factor used to estimate the drawn portion of an undrawn commitment.

Exposure at default: Expected exposure when a default occurs.

Risk-adjusted return: Return assessed after considering expected loss, capital and risk.

Model risk: Risk of adverse consequences from incorrect or misused models.

Beneficial owner: Natural person who ultimately owns or controls a customer or entity.

Ethical lending: Lending that is lawful, fair, transparent, suitable and socially responsible.

Review Questions

Short Answer Questions

1. What is the difference between risk appetite and risk capacity?
2. Identify four essential components of a credit policy.
3. Why should undrawn commitments be considered in exposure measurement?
4. What are the respective responsibilities of the second and third lines?
5. Why is collateral considered a secondary source of repayment?

Long Answer Questions

1. Explain how a bank can translate a board-level risk-appetite statement into operational credit limits and triggers.
2. Discuss the design principles of an effective delegation-of-authority matrix.
3. Analyse how connected borrowers and common economic dependencies create concentration risk.
4. Explain the role of exceptions, breaches and escalation in credit governance.
5. Evaluate the ethical and regulatory responsibilities involved in automated credit decisions.

Analytical / Application Questions

1. A bank has eligible capital of 1,200 million currency units and sector exposure of 204 million. Calculate the sector concentration ratio and assess it against a 20% limit and an 18% management trigger.
2. Design a governance response when a business unit repeatedly exceeds its exception threshold but remains within its formal exposure limit.
3. Using the Meridian Bank case, identify two control failures, two incentive failures and three corrective actions that should be reported to the board.

Multiple Choice Questions with Answers

Question 1

Which statement best distinguishes risk appetite from risk capacity?

A. Risk appetite is the maximum legally permitted exposure, while capacity is the target exposure.

B. Risk appetite is the risk the bank intends to accept, while capacity is the risk it can absorb.

C. Risk appetite applies only to market risk, while capacity applies only to credit risk.

D. Risk appetite is set by relationship managers, while capacity is set by borrowers.

Correct Answer: B. Risk appetite is the risk the bank intends to accept, while capacity is the risk it can absorb.

Question 2

A bank has eligible capital of 800 million currency units and sector exposure of 136 million. What is the concentration ratio?

A. 14%

B. 16%

C. 17%

D. 20%

Correct Answer: C. 17%

Question 3

Which activity is primarily a second-line responsibility?

A. Originating and selling a loan

B. Executing collateral documentation

C. Independently monitoring limits and challenging credit proposals

D. Performing the borrower’s external audit

Correct Answer: C. Independently monitoring limits and challenging credit proposals

Question 4

Under the exposure-at-default expression EAD = D + α × U, what does α represent?

A. The borrower’s probability of default

B. The approved conversion factor applied to undrawn commitments

C. The collateral haircut

D. The annual interest rate

Correct Answer: B. The approved conversion factor applied to undrawn commitments

Question 5

Why should connected borrowers be aggregated for concentration analysis?

A. They always have identical loan contracts.

B. They may share ownership, control or economic dependence.

C. They are automatically risk-free when legally separate.

D. Regulations prohibit lending to all related entities.

Correct Answer: B. They may share ownership, control or economic dependence.

Question 6

Which is the strongest example of an approved credit exception?

A. An undocumented deviation routinely used by sales staff

B. A deviation with rationale, compensating controls, approver and expiry date

C. A verbal waiver granted after disbursement

D. A breach hidden until the next annual review

Correct Answer: B. A deviation with rationale, compensating controls, approver and expiry date

Question 7

What is the principal purpose of a management trigger set below a formal limit?

A. To eliminate all lending activity

B. To provide early warning and allow corrective action before breach

C. To replace regulatory limits

D. To guarantee that no borrower will default

Correct Answer: B. To provide early warning and allow corrective action before breach

Question 8

Which statement reflects ethical lending?

A. Collateral makes affordability assessment unnecessary.

B. Customer data may be used without lawful purpose if the model is accurate.

C. The bank should explain material costs and assess suitability and repayment ability.

D. High sales growth is evidence of fair treatment.

Correct Answer: C. The bank should explain material costs and assess suitability and repayment ability.

Question 9

What is the third line in the three-lines model?

A. Business origination

B. Risk management and compliance

C. Internal audit

D. Loan recovery operations

Correct Answer: C. Internal audit

Question 10

A commitment has 40 million drawn and 60 million undrawn. If the approved conversion factor is 0.5, what is EAD?

A. 50 million

B. 60 million

C. 70 million

D. 100 million

Correct Answer: C. 70 million