In the banking world, there is a variety of practice with respect to the risk rating process, ranging from systems almost purely driven by statistical models, like credit scoring, to those based almost exclusively upon judgement. Generally three broad process categories can be discerned, according to the degree to which the risk rating is a product of mathematical models or of decisions of judgement (Grupo Santander 2000):

For corporate lending, most rating systems are based on quantitative and qualitative evaluation. More and more financial institutions adopt a two-tier rating system. Firstly, a borrower risk rating linked to the probability of default concept. Secondly, a facility risk rating linked to the loss given default concept. Facility risk rating (FRR) depends on the seniority of the facility and the quality of the securities.

At this stage the links between risk rating, provisioning and capital charges are discussed.

The pricing is calculated as follow: where:

The cost of fund depends on reserve requirement, diversity and availability of funding channels, the base lending rate and the risk related to the financial institution. It needs to be assigned to lending activities.

In the financial world, to correctly price loans and other credit products is paramount to the lender’s success. If a financial institution prices its loans too low in relation to the risk associated with the loans, its financial strength will deteriorate and this could affect its survival over time. At the opposite end, if the financial institution prices its loans too high, its competitiveness will deteriorate which would also affect its survival over time.

This chapter outlines the principles behind risk pricing and corporate lending. The concepts of probability of default, loss given default, provisioning, capital charges, pricing and cost of funds, the risk rating system and the methodology to apply the risk rating system are also discussed.

Globally, more and more commercial banks and other financial institutions adopt a two-tier rating system as a requirement of the Basel Committee on Banking Supervision (2004). The system is composed of a borrower risk rating (BRR) linked to the probability of default concept and a facility risk rating linked to the loss given default concept. FRR depends on the seniority of the facility and the quality of the security.

Worldwide, the key issue for financial institutions is obtaining the right information and reliable data on borrowers or the borrowers’ exposure. The credit analyst must assess the information available (data collection) in order to assess the risk. This is why analysts require experience and expertise to identify both reliable and unreliable data. Similarly it is difficult to rely on an automatic scoring system for larger borrowers.

The easiest method of PD estimation is based on historical data, where estimates are made for each rating grade. This data could be built internally and/or taken from external sources. However, for a specific internal RRS, it is preferable for a financial institution to build its own database that corresponds to its environment and specific market involvement. The PD does not include a loss component but only the number of defaults within a given time period. Basel II requires estimating one year PDs based on long maturity average (minimum five years).

The formula is:

Most financial institutions adopt the dual method to estimate LGD. For acceptable (from very low to moderate) risk rates, they attribute to each security and to each maturity a LGD estimate based on historical data. Basel II requires estimating one year LGD based on long maturity average (minimum seven years).

For high and very high risks, LGD becomes specific and usually takes into consideration:

The rating process includes quantitative, qualitative and legal analyses. The quantitative analysis is mainly based on the client’s financial report. The credit analyst should analyse the financial strength of the borrower in order to determine if cash flow is sufficient to cover its global debt. Then the asset’s quality and the liquidity position of the borrower are analysed in order to determine whether or not the borrower’s organisation could survive in an unexpected difficult situation such as economic recession (robust finance).

The qualitative analysis is mainly about the quality of management, the organisation’s competitiveness within its own industry and its vulnerability to changes in technology, labour relations and regulatory changes. Regarding the industry, the analyst should take into account the environment and characteristics of the industry to which the borrower belongs, and the position of the borrower within this industry. The analyst should also consider the macro-economic situation and its eventual impact on the client. Finally, the analyst should identify the authenticity and legality of the establishment of the borrower through a legal analysis.

It should be borne in mind that a strong security (or collateral) does not improve the borrower rating since it has no (or very low) impact on the probability of default. Therefore, if the BRR is not acceptable as per the financial institution’s policy, no security could deter a reject decision. The only exception to this rule is the cash collateral where the loan is fully secured by a cash deposit or equivalent. However, security serves only as a mitigating factor given the BRR is acceptable.

The maturity of the facility also contributes to the FRR, i.e. the longer the maturity the riskier it becomes.

In the case of a lack of reliable data on expected losses, financial institutions normally take two types of provisioning: general and specific. Specific provisions are made for losses recognised at the balance sheet date. A loss is recognised when the financial institution considers that the creditworthiness of a borrower has undergone such deterioration that the financial institution no longer expects to recover the loan advance in full. Regarding general provisions, they should be for advances already impaired but not yet identified as such. In order to protect the financial institution’s capital base from the damage of these losses, the financial institution shall pre-set proper provisioning proceeds as the ‘buffer’, which is usually from the interest income of each loan.

Nowadays, Basel II (Basel Committee on Banking Supervision 2004) adopts more or less the same philosophy but introduces a new risk factor, the operational risk. The equation now becomes:

This concept considerably affects the pricing. The cost of funds included in the pricing is defined as the total cost of debt and cost of capital. The cost of capital is the rate of return required by shareholders. The capital is a buffer against losses. Therefore the return on capital should be risk adjusted return on capital (RAROC).

In project finance initiative (PFI) projects, for example, in a project scoring 3 on a 1 to 7 grading (which is usually the case) for every drawn pound, a pound has to be put away, and for every undrawn pound loaned 75 pence has to be put away. Previous to Basel II for every pound drawn, a pound had to be put away and for every undrawn pound loaned, 50 pence had to be put away. This was usually across the board irrespective of whether the loan was lending to junk or safer assets such as PFI projects. In effect PFI assets were discriminated against.

Although for Credit Grade 3, as cited in the above example, the undrawn is 25 pence more under Basel II, it is the corporate lending that suffers since the PD/LGD is much higher for corporate lending since you may only get back 12 pence in the pound under a default situation.

The cost of the fund depends on reserve requirement, diversity and availability of funding channels, the base lending rate and finally the risk related to the financial institution itself. Northern Rock recently got into financial difficulties because interbank loans margins increased due to liquidity issues (uncertainty in the market). The cost of borrowing increased dramatically and the bank had to rely on the Bank of England to resolve the short-term cash flow issues. It is important to note that Northern Rock is a profitable organisation; further enhancing the importance of cash flow management.

Commitment fees on loan facilities are usually the secondary income resource for a financial institution. They are supposed to cover specific overhead costs related to facilities and monitoring.

This internal transfer pricing is usually calculated by the treasury department in a bank. Hempel and Simonson (1999) summarised that most banks use a matched maturity framework that assigns rates by identifying the effective maturity of assets and assigning a rate obtained from a liability of the same maturity.

A good RRS should offer a carefully designed, structured and documented set of steps for the assessment of each rating. Therefore, an RRS should incorporate a comprehensive and standardised grid analysis. The goal is to generate accurate and consistent RRS, and also to integrate professional judgement to the rating process. Normally, a risk rating methodology (RRM) initiates a BRR that identifies the expected PD of that borrower (or group) in repaying its obligations in the normal course of business. Then, the RRS identifies the risk of loss by assigning an FRR to each credit facility granted to a borrower. RRS quantifies the quality of individual facilities, credits and portfolios. If an RRS is accurately and consistently applied, they provide a common understanding of risk levels and allow for active portfolio management. An RRS also provides the initial basis for capital charges used in various pricing models. It can also assist in establishing loan reserves. In order to keep the rating system consistent with the credit migration, the definition of every rating has to be reviewed at least once a year.

In addition, a clear early warning signal process is incorporated in the model. The early warning signal process is the tool that helps the financial institution to track risk profile changes of the borrower between two reviews. Many studies have confirmed that a high percentage of avoidable losses might have been reduced or avoided had early warning signals been recognised and heeded, and remedial action been initiated in a timely manner.

In the case of multiple collaterals being provided for one facility, the credit analyst should score the higher rate if, at least, one collateral is within the percentage financing parameters. Otherwise it should score the lowest rate.

For every customer credit analysis, the financial institution needs to recognise the importance of the quality of the financial information initially provided. The information provided must always fully satisfy the quality, adequacy and reliability of the financial statement. The size and reputation of the accounting firm shall be inline with the size and complexities of the borrower and its financial statement.

Then, the credit analyst can analyse the borrower via the ‘CAMP’ model. CAMP refers to Cash (financial analysis), administration (management), market, and production. The analyst shall evaluate the borrower on these four aspects and compute a score. The resulting score will fall into a BRR rating range. The analysis should also be done according to the industry and current trend. The scoring can be distributed as follows:

The two main regulations in operational risk management have been the Basel Accord which has evolved over time to the new Basel II and the Sarbanes-Oxley Act of 2002. Together they are dominating headlines and giving a lot of compliance headaches to financial institutions, especially US banks. Some critics have questioned whether the two are in conflict.

The committee defines operational risk as the risk of direct or indirect loss resulting from inadequate or failed internal processes, people and systems or from external events. This includes legal risk but excludes strategic and reputation risks, although a significant operational loss can affect the reputation of an organisation.

In mid 2004, after a protracted period of consultations, the Basel Committee finally released its definitive proposals on capital charges for operational risk under Basel II. In its proposals it allows internationally active banks to calculate regulatory capital using their own internal models. It therefore has moved away from its original focus on quantitative techniques. It now concentrates on qualitative standards for operational risk management (ORM) systems.

Under Basel II, financial institutions must implement an operational risk management system with an independent operational risk management function responsible for developing and implementing ‘strategies, methodologies and risk reporting systems to identify, measure, monitor and control/mitigate operational risk’ (Basel Committee on Banking Supervision 2004). To comply with these requirements the ORM system must also be capable of being validated or reviewed regularly by internal and/or external auditors and be seen to ‘have and maintain rigorous procedures’.

The Basel II Accord provides three methods for calculating operational risk capital charges:

To qualify to use the AMA approach to calculate operational risk under Basel II, a bank must meet stringent ‘qualitative standards’ (Basel Committee on Banking Supervision 2004) those being:

The accord also provides three methods of calculating reserve requirements:

There are issues raised on the lack of clear direction in developing approaches to managing operational risk and for supervisors in standardising these approaches.

Patrick McConnell (2004) outlines some of the questions arising due to the lack of clarity, including:

Spielman continues to argue that, whether financial institutions agree with Basel II or not, they would be hard pressed to dispute the benefits of some key components of the AMA, which improve how they manage their institutions. For example, self-assessment is a proven vehicle to building a better risk management culture that helps facilitate transparency from top to bottom. Most business managers will see the value of gaining a greater understanding of how their people, processes, technology and other risk may impede their business goals. Tracking losses and non-financial events that can impact business goals is a great indicator of control effectiveness, and can trigger questions about when trends start to shift in the wrong direction. Audit is essential to the process, and considering audit’s input helps to present a balanced view of risk.