Credit Rating, Scoring and Default-Risk Models

Introduction and context

Credit decisions are fundamentally decisions under uncertainty. A lender does not observe with certainty whether a borrower will repay, how much collateral will be recovered after failure, or how large the exposure will be when default occurs. Credit rating, scoring and default-risk models convert available information into structured estimates that support pricing, approval, limit setting, monitoring, provisioning and capital allocation.

The central quantities are probability of default (PD), loss given default (LGD) and exposure at default (EAD). Together they support the expected-loss relationship:

Here, EL is expected loss measured in currency, PD is a probability between 0 and 1, LGD is a loss proportion between 0 and 1, and EAD is the monetary exposure expected at default. The relationship assumes that the three quantities are defined over a consistent time horizon and default definition. It is an expectation, not a prediction of the loss on a particular account.

Modern credit-risk practice combines expert judgment, internal ratings, statistical scorecards, credit-bureau information, cash-flow analysis and portfolio models. A sound model is therefore not merely a mathematical instrument. It is part of a governance system involving data quality, validation, controls, human judgment, regulation and ethical treatment of borrowers.

Learning objectives

By the end of this chapter, the reader should be able to:

1. Distinguish internal ratings, application scorecards and behavioural scorecards.
2. Explain the construction and interpretation of PD, LGD and EAD estimates.
3. Construct and interpret a credit-rating transition matrix.
4. Evaluate credit-bureau data and its limitations.
5. Interpret discrimination, calibration, stability and validation measures.
6. Design a responsible model-governance and monitoring framework.
7. Apply these concepts to lending strategy, pricing and portfolio management.

1. Credit assessment architecture

A bank’s credit process normally has several layers. Origination gathers borrower, facility and transaction information. A rating or score estimates risk. Credit policy converts risk into an approval, decline, limit or collateral decision. Pricing reflects expected loss, capital usage, operating cost and target return. Monitoring identifies deterioration and triggers early intervention.

Internal ratings

An internal rating is an ordered classification of obligor or facility credit quality. Typical grades may run from investment-grade categories to default, although the labels and number of grades vary by institution. Ratings are usually assigned to an obligor—such as a company or sovereign—or to a facility after considering transaction-specific features.

An obligor rating reflects the borrower’s general capacity and willingness to repay. A facility rating additionally reflects seniority, security, guarantees, documentation and recovery prospects. The distinction matters: two loans to the same borrower can have different LGDs even when their borrower-level PD is identical.

Ratings may be based on financial ratios, industry position, management quality, qualitative judgment, cash-flow analysis, market information and external data. Corporate ratings often combine a quantitative model with a credit officer’s expert assessment. Override authority should be limited, documented and independently reviewed.

Application scorecards

An application scorecard is built for decisions at origination. It uses information available before or at application—for example income, employment stability, debt obligations, requested amount, loan-to-value ratio, bureau history and prior relationship data. Its purpose is to rank new applicants according to estimated risk.

A common statistical approach is logistic regression. If p is the probability of default and x₁,…,xₖ are applicant characteristics, the model may be written as:

The left side is the log-odds of default; β₀ is the intercept; βᵢ are estimated coefficients; and xᵢ are predictor values. The equation applies when the log-odds specification is appropriate and observations are defined consistently. The resulting probability is:

where η = β₀ + ∑βᵢxᵢ. Logistic regression does not require the predictors themselves to be normally distributed, but it requires careful treatment of nonlinearity, missing values, dependence and sample selection.

Scorecards often transform variables into weight-of-evidence (WoE) values. For a category j, one convention is:

where Goodⱼ and Badⱼ are counts in category j, and Good and Bad are total counts. Some institutions use the reverse sign; the convention must be documented. WoE supports interpretable, approximately monotonic relationships, but it can be unstable in small or shifted samples.

Behavioural scorecards

A behavioural scorecard uses performance observed after account opening. Variables can include repayment delinquency, utilisation, payment-to-balance ratio, overdraft frequency, deposit inflows, balance volatility, cash withdrawals and recent limit changes. The score is intended for account management: limit increases, collections segmentation, repricing, restructuring and early-warning intervention.

Behavioural models can be more predictive than application models because they use realised performance. They also create risks of feedback and circularity. For example, a bank that reduces a customer’s limit because of a deteriorating score may cause utilisation to rise, making the score appear worse. Model developers must distinguish borrower behaviour from bank-imposed actions.

2. From default definitions to PD

Defining default

A PD estimate is meaningful only when “default” is precisely defined. A definition may include a material payment past due, a distressed restructuring, bankruptcy, charge-off or an assessment that the borrower is unlikely to pay. The observation window, materiality threshold, cure treatment and treatment of multiple defaults must be specified.

A weak default definition produces incomparable data and misleading validation. For example, a 90-day-past-due definition may identify default later than a distressed-restructuring definition. The same borrower can therefore appear to default at different dates under different policies.

Point-in-time and through-the-cycle PD

Point-in-time (PIT) PD responds to current macroeconomic and borrower conditions. Through-the-cycle (TTC) PD aims to represent long-run average risk across economic conditions. PIT estimates are useful for current underwriting and stress testing; TTC estimates are often more stable for strategic rating systems and capital planning. Neither is universally superior: the appropriate choice depends on the decision purpose and regulatory framework.

For a homogeneous group with d defaults among n obligors over a defined horizon, the crude observed default rate is:

This estimate is simple but can be distorted by small samples, censoring, seasoning, portfolio growth, withdrawals and changes in underwriting. A confidence interval or a Bayesian estimator may be preferable where data are sparse. If a one-year hazard rate λ is assumed constant, the corresponding cumulative default probability over t years is:

This conversion is valid only under the constant-hazard assumption. In practice, hazard rates often vary by age, rating, macroeconomic conditions and borrower characteristics.

Lifetime PD and marginal PD

For a multi-period exposure, marginal PD is the probability of default in a particular period conditional on being alive at the beginning of that period. Cumulative PD is the probability of default by a specified date. If qₜ is the marginal conditional PD in period t, cumulative survival through t is:

and cumulative PD is:

The product assumes that qᵢ is defined conditionally on survival to period i. Summing marginal conditional PDs would generally overstate cumulative PD because it ignores the fact that some borrowers have already defaulted.

3. LGD: estimating loss severity

LGD measures the proportion of exposure not recovered after default. A simple realised workout definition is:

PV denotes present value measured at the relevant reference date. Recoveries may include cash collections, collateral proceeds and payments from guarantors. Workout costs include legal, repossession, servicing and preservation costs. The discount rate and recovery timing must be specified.

If EAD is 1,000, recoveries are 600 received after one year, workout costs are 50 paid at the same time, and the annual discount rate is 10%, then net recovery is 550 and its present value is:

Therefore:

The calculation assumes all recovery and cost cash flows occur at the end of year one and that EAD is measured at default. If recoveries occur at different dates, each cash flow should be discounted separately.

LGD is affected by collateral type and enforceability, loan seniority, jurisdiction, borrower industry, default cycle, cure rates and collection strategy. “Downturn LGD” incorporates adverse economic conditions and may exceed average historical LGD. A bank should avoid treating collateral’s market value as equivalent to recovery value: liquidation discounts, time, legal uncertainty and costs matter.

4. EAD and credit conversion

EAD is the exposure expected to be outstanding when default occurs. For a term loan, it may be close to principal plus accrued amounts, subject to repayment schedules. For revolving facilities, future drawings must be estimated.

A common formulation for an undrawn commitment is:

where CCF is the credit conversion factor, measured between 0 and 1 in this simplified setting. If drawn exposure is 70, undrawn commitment is 30 and CCF is 0.40, then EAD = 70 + 0.40 × 30 = 82.

The formulation assumes a linear conversion of undrawn capacity and a stable definition of drawn and undrawn amounts. In reality, CCF can depend on utilisation, limit management, borrower type, product, time to default and macroeconomic conditions. Banks should consider whether borrowers draw more before default and whether the institution cancels or restricts commitments.

5. Expected loss, unexpected loss and decision use

Expected loss is the probability-weighted average loss. For a portfolio of exposures i:

This additive expression is appropriate for expected loss across exposures when each component is consistently defined. It does not capture loss dependence or portfolio concentration. Unexpected loss concerns the dispersion around expected loss and is influenced by correlation, concentration, model uncertainty and the loss distribution. Capital is intended to absorb severe but plausible unexpected losses, while pricing and provisions generally reflect expected loss subject to the applicable accounting and regulatory framework.

For a facility with PD = 2%, LGD = 45% and EAD = 500,000:

The amount is an average loss estimate over the specified horizon, not an amount that must be deducted from this single facility.

6. Rating transition matrices

A transition matrix records movements between rating grades over a specified period. Each row represents the starting grade and each column the ending grade, including default and sometimes withdrawal. A row-normalised one-year matrix P has entries pᵢⱼ satisfying:

where Nᵢⱼ is the number moving from grade i to grade j and Nᵢ is the number initially in grade i. Each complete row should sum to 1, subject to rounding.

Illustrative one-year matrix:

The default column provides an empirical one-year default probability for each starting grade, assuming the data, population and default definition are appropriate. The matrix also reveals rating stability, migration risk and possible notch asymmetry. A high downgrade rate may signal deterioration before default.

For multi-year analysis, transition matrices may be multiplied if the Markov assumption holds. Under that assumption, the probability of moving from state i to state j in two periods is an element of P². The assumption means that the next transition depends on the current state, not on the full historical path. This is often an approximation; ageing, macroeconomic regimes and prior rating momentum may violate it.

Matrices require careful treatment of withdrawn ratings, mergers, censored observations and time-varying portfolios. A cohort approach follows the same initial population; a duration approach uses exposure observed in each period. Mixing methods can create biased transition estimates.

7. Credit-bureau data

Credit bureaus aggregate information from lenders and other permitted sources. Useful fields include outstanding balances, repayment history, utilisation, recent enquiries, account age, credit limits, delinquency status, write-offs and public-record events. Bureau data can improve risk differentiation, reduce information asymmetry and identify over-indebtedness.

However, bureau data are not a complete representation of creditworthiness. Reporting may be delayed, inconsistent or absent for informal lenders. Identity matching can create false links. Closed accounts, disputed data, thin files and different lender reporting conventions affect interpretation. Recent enquiries may indicate credit shopping rather than distress, while high utilisation may reflect either financial stress or deliberate use of a revolving facility.

Responsible use requires lawful access, purpose limitation, data accuracy, dispute mechanisms, security, retention controls and adverse-action explanations. A bureau variable should not be used merely because it improves predictive performance; its meaning, legality, stability and fairness must also be assessed.

8. Model development and validation

Development principles

A robust development process includes a clearly defined target, observation and performance windows, representative sampling, leakage controls, missing-data policy, variable transformation, segmentation strategy and out-of-time testing. The performance window must follow the observation window; using information recorded after the decision date is target leakage.

Variables should have plausible economic meaning. A model that performs well because of a temporary operational code or a post-default collection flag is not a sound underwriting model. Sample selection also matters: a model developed only on approved applicants may suffer from reject inference because the repayment outcomes of declined applicants are unobserved.

Discrimination

Discrimination is the ability to rank higher-risk borrowers above lower-risk borrowers. The area under the receiver operating characteristic curve (AUC) is a common measure. AUC is the probability that a randomly selected defaulter receives a riskier score than a randomly selected non-defaulter, with ties handled by convention. AUC = 0.5 indicates random ranking; AUC = 1 indicates perfect ranking.

The Kolmogorov–Smirnov statistic is:

where F_D(s) and F_N(s) are cumulative score distributions for defaulters and non-defaulters at threshold s. KS measures the maximum separation, but it does not by itself establish calibration or economic value.

Calibration

Calibration asks whether predicted probabilities match observed event frequencies. A group predicted at 3% PD should default at approximately 3% over the relevant population and horizon, subject to sampling variation. A calibration table compares predicted and observed rates by score band. The Brier score for binary outcomes is:

where n is the number of observations, pᵢ is predicted PD and yᵢ equals 1 for default and 0 otherwise. Lower values are better, but the Brier score depends on event prevalence and should not replace discrimination analysis.

A model may rank borrowers effectively but systematically underpredict risk. Conversely, a model can be well calibrated overall yet have weak ranking power. Both properties are important, and calibration should be tested out of time and across material segments.

Stability and drift

Population stability compares the distribution of a characteristic or score between development and current samples. For bins j, a commonly used index is:

where Aⱼ is the current proportion and Eⱼ is the expected or development proportion in bin j. Both proportions must be positive; zero bins require a documented treatment. PSI indicates distributional shift, not necessarily deterioration in predictive accuracy. Drift investigation should examine approval policy, applicant mix, macroeconomics, data pipelines and score performance.

Validation should also include back-testing, benchmark models, sensitivity analysis, stress testing, override analysis, stability by segment, outcome timing and independent review. Model uncertainty can be represented through conservative margins, scenario analysis or parameter ranges.

9. Governance, regulation and ethics

A model-risk framework should assign accountability to model owners, developers, validators, users and senior management. Essential controls include a model inventory, documented purpose and limitations, version control, approval records, change management, access controls, monitoring thresholds, issue escalation and periodic review.

Explainability is especially important in consumer lending. A borrower should receive meaningful reasons for an adverse decision, not merely a technical score. Reasons should be sufficiently specific to support correction or responsible financial action while protecting security and proprietary information.

Fair lending requires testing for disparate outcomes and unjustified disparities across protected or vulnerable groups, subject to applicable law. Removing a protected attribute does not guarantee fairness because proxy variables may remain. Fairness assessment must distinguish legitimate risk factors from variables reflecting historical exclusion, unequal access to credit or discriminatory institutional practices.

Human review is not automatically safer than automation. Unstructured overrides can introduce inconsistency and bias. Conversely, fully automated decisions may fail when data are missing or circumstances are exceptional. A controlled hybrid process uses clear override reasons, authority limits, audit trails and outcome monitoring.

10. Technology and contemporary developments

Machine-learning methods—such as gradient boosting and random forests—can capture nonlinearities and interactions that traditional scorecards may miss. They may improve predictive performance, but they can be less transparent, more sensitive to drift and harder to validate. Governance should compare incremental performance against explainability, stability, fairness, operational complexity and cost.

Alternative data, open banking and real-time transaction information can improve cash-flow assessment, particularly for thin-file borrowers. They also raise consent, privacy, cybersecurity and data-quality concerns. Generative AI may assist documentation, analyst workflows and anomaly detection, but it should not independently make high-impact credit decisions without controlled data, validation, human accountability and monitoring.

Climate, cyber and geopolitical risks increasingly affect borrower PD, LGD and EAD. Their effects may be transmitted through revenue disruption, asset-value declines, insurance availability, supply chains and refinancing conditions. These risks should be incorporated through scenario analysis and sector-specific assessment rather than by applying an arbitrary universal surcharge.

11. Integrated applied case: Meridian Bank’s revolving-credit portfolio

The following is an illustrative case, not a report of an actual bank.

Background

Meridian Bank issues revolving credit lines to small businesses. Delinquencies have increased, but the bank’s existing application scorecard remains calibrated to a benign economic period. Management wants a behavioural scorecard, revised EAD estimates and an early-warning strategy.

Problem

The portfolio contains 10,000 accounts. A review finds that high utilisation, repeated overdrafts and falling deposit inflows precede delinquency. The old model uses only application variables and estimates a uniform EAD equal to current drawn balance, understating likely exposure before default.

Analysis

The bank defines default as 90 days past due, charge-off or distressed restructuring within twelve months of the observation date. It creates a six-month observation window and a twelve-month performance window. Predictors are frozen at the observation date to prevent leakage.

A behavioural model identifies three risk bands. Validation shows that the high-risk band contains 20% of accounts but 55% of observed defaults. However, the model’s predicted PD for the high-risk band is 8%, while observed PD is 10%; it therefore discriminates effectively but under-calibrates risk in that band.

For a representative high-risk account, current drawn balance is 60,000, undrawn commitment is 40,000 and estimated CCF is 0.50. Thus:

Suppose revised PD is 10% and downturn LGD is 55%. Expected loss is:

The old method would have calculated 0.08 × 0.45 × 60,000 = 2,160, materially understating expected loss. The difference results from all three components: calibration, severity and pre-default drawdown.

Approach and solution

Meridian introduces monthly monitoring of utilisation, inflow decline and missed payments. High-risk accounts receive contact from relationship managers, affordability review and temporary limit controls subject to customer-protection rules. Pricing and provisioning use approved PD, LGD and EAD estimates rather than raw scores. Overrides require documented reasons and are reviewed for segment bias.

The bank also tests whether limit reductions themselves cause subsequent utilisation stress. It finds that aggressive unexplained reductions increase complaints and short-term delinquency for some viable firms. The policy is therefore changed to combine early communication, tailored repayment arrangements and graduated controls.

Outcome

After two quarters, early intervention reduces roll rates into severe delinquency, while monitoring confirms that the score’s calibration improves after a conservative recalibration. The bank does not conclude that the model caused the improvement without a controlled comparison; it uses a matched pilot group and continues out-of-time validation.

Learning points

1. A score is not a PD until it is calibrated to a defined population and horizon.
2. EAD for revolving credit must reflect likely pre-default utilisation.
3. Downturn LGD can materially change expected loss.
4. Behavioural models support action but may be affected by the bank’s own interventions.
5. Model performance, customer outcomes and fairness must be monitored together.

Best-practice implementation checklist

A lending institution should:

• define default, horizon, cure and exposure consistently;
• separate development, validation and monitoring data;
• prevent target leakage and document missing-data treatment;
• assess both ranking and calibration;
• validate PIT/TTC purpose and macroeconomic sensitivity;
• estimate recoveries net of timing and workout costs;
• model undrawn commitments and pre-default utilisation;
• test transitions, drift, overrides and segment performance;
• maintain independent validation and change control;
• provide meaningful adverse-action explanations;
• monitor fairness, privacy, cybersecurity and data rights;
• retain expert judgment without permitting undocumented discretion.

Chapter Summary

Credit rating and scoring systems translate borrower and facility information into structured risk assessments. Internal ratings classify obligor or facility quality, application scorecards support origination, and behavioural scorecards use account performance for ongoing management. The principal risk components are PD, LGD and EAD, whose product provides expected loss when definitions, horizons and units are consistent. PD requires a precise default definition and may be point-in-time, through-the-cycle, marginal or cumulative. LGD must reflect recovery timing, costs, collateral realisation and economic conditions. EAD must include potential drawings on revolving commitments.

Transition matrices reveal migration and default patterns but depend on appropriate cohort, censoring and Markov assumptions. Credit-bureau data improve information but require accuracy, lawful use and careful interpretation. Model validation must distinguish discrimination from calibration and examine stability, drift, bias and uncertainty. Governance, explainability, fairness, privacy and human accountability are integral to responsible credit modelling. The strategic value of a model lies not only in predictive power but also in the quality of decisions and outcomes it supports.

Key Terms

PD: Probability that an obligor or facility defaults over a defined horizon.

LGD: Proportion of exposure lost after accounting for recoveries, costs and timing.

EAD: Exposure expected to be outstanding when default occurs.

Expected loss: Probability-weighted average credit loss.

Internal rating: Ordered classification of obligor or facility credit quality.

Application scorecard: Origination model using information available at application.

Behavioural scorecard: Model using post-origination account performance.

Point-in-time PD: Risk estimate responsive to current conditions.

Through-the-cycle PD: Long-run average risk across economic conditions.

Cumulative PD: Probability of default by a specified date.

Marginal PD: Conditional probability of default in a particular period.

Transition matrix: Matrix showing movements between rating states.

Credit conversion factor: Estimated proportion of undrawn commitment drawn by default.

AUC: Area under the ROC curve, measuring ranking discrimination.

KS statistic: Maximum separation between cumulative defaulter and non-defaulter distributions.

Calibration: Agreement between predicted probabilities and observed event rates.

Population stability index: Measure of distributional change between samples.

Target leakage: Use of information unavailable at the decision date.

Reject inference: Methods for addressing unobserved outcomes of declined applicants.

Model governance: Controls governing development, approval, use, monitoring and change.

Review Questions

Short Answer Questions

1. Distinguish an internal rating from an application scorecard.
2. Why must default be defined before PD can be estimated?
3. Explain the difference between marginal and cumulative PD.
4. What does the EAD formula for a revolving facility attempt to capture?
5. Why does a high AUC not guarantee good calibration?

Long Answer Questions

1. Explain the construction, interpretation and governance of PD, LGD and EAD estimates.
2. Discuss the uses and limitations of rating transition matrices, including the Markov assumption.
3. Compare application and behavioural scorecards in terms of data, use, predictive value and risks.
4. Evaluate the role of credit-bureau data in responsible lending decisions.
5. Design a model-validation framework covering discrimination, calibration, stability, fairness and governance.

Analytical / Application Questions

1. A facility has PD of 3%, LGD of 40%, drawn balance of 120,000 and undrawn commitment of 80,000. If CCF is 30%, calculate EAD and expected loss.
2. A score band predicts 4% default but records 6% default out of time. Diagnose possible causes and recommend corrective action.
3. A bank’s behavioural model ranks risk well, but limit reductions appear to increase delinquency. Analyse the feedback mechanism and propose a controlled policy evaluation.

Multiple Choice Questions with Answers

Question 1

A facility has PD of 2%, LGD of 45% and EAD of 500,000. What is its expected loss?

A. 2,250

B. 4,500

C. 22,500

D. 45,000

Correct Answer: B. 4,500

Question 2

Which model primarily uses information observed after an account is opened?

A. Application scorecard

B. Behavioural scorecard

C. Origination policy rule

D. Transition matrix

Correct Answer: B. Behavioural scorecard

Question 3

If drawn exposure is 70, undrawn commitment is 30 and CCF is 0.40, what is EAD?

A. 70

B. 82

C. 100

D. 112

Correct Answer: B. 82

Question 4

What does AUC primarily measure?

A. Recovery timing

B. Ranking discrimination

C. Collateral value

D. Exposure utilisation

Correct Answer: B. Ranking discrimination

Question 5

A one-year transition-matrix row contains probabilities of 0.90, 0.08, 0.015 and 0.005. What is the default probability from that starting grade?

A. 0.05%

B. 0.5%

C. 1.5%

D. 5%

Correct Answer: B. 0.5%

Question 6

Which statement best describes calibration?

A. It measures whether scores are monotonic

B. It measures whether predicted probabilities match observed event rates

C. It measures collateral enforceability

D. It measures the number of rating grades

Correct Answer: B. It measures whether predicted probabilities match observed event rates

Question 7

Under the constant-hazard assumption, cumulative PD over t years is represented by which expression?

A. λ ÷ t

B. 1 − exp(−λt)

C. 1 + exp(−λt)

D. λ × t only in all cases

Correct Answer: B. 1 − exp(−λt)

Question 8

Which item is normally included in a recovery-based LGD calculation?

A. Only the original loan amount

B. Present value of recoveries net of workout costs

C. Only the borrower’s application score

D. The bank’s total capital ratio

Correct Answer: B. Present value of recoveries net of workout costs

Question 9

What is target leakage?

A. A decline in portfolio approval rates

B. Use of information unavailable at the decision date

C. A rating migration to a better grade

D. A missing credit-bureau record

Correct Answer: B. Use of information unavailable at the decision date

Question 10

Which is a major limitation of credit-bureau data?

A. They never contain repayment information

B. They may be incomplete, delayed or affected by reporting inconsistencies

C. They cannot be used for underwriting

D. They always eliminate model bias

Correct Answer: B. They may be incomplete, delayed or affected by reporting inconsistencies