Summary Credit risk governance in banks is often organised as a set of separate disciplines — underwriting policy, IFRS 9 provisioning, concentration management, credit stress testing — each with its own committees and its own models. Integration across them is where the CRO and board add most value. This article sets out how to run credit risk governance as a coherent framework.
Underwriting standards Underwriting is the point at which credit risk enters the balance sheet. Standards should express the bank's credit appetite in operable rules: minimum affordability, collateral requirements, sector exposure, product structure, and treatment of exceptions. Exception management is a proxy for underwriting discipline; a high exception rate signals either mis-calibrated policy or weak enforcement.
IFRS 9 provisioning IFRS 9 introduced forward-looking expected credit loss (ECL) provisioning. Its governance implications are material: models must be validated, macroeconomic scenarios approved, staging criteria monitored, and management overlays governed. Overlays are legitimate — no model captures every emerging risk — but they must be documented, time-limited and reviewed.
Concentration management Concentration risk is often the difference between a difficult year and a serious loss event. Governance should cover single-name, sector, geography and product concentrations, with limits that bind and MI that surfaces build-ups early. Concentration is not addressed by aggregation alone; correlation and contagion patterns matter.
Credit stress testing Credit stress testing feeds ICAAP, capital planning, appetite calibration and, increasingly, IFRS 9. The scenarios should be internally consistent (macro variables that co-move plausibly), sufficiently severe (to be decision-useful), and tied to the bank's actual portfolio composition rather than to a benchmark portfolio.
Integration The four disciplines should share a common taxonomy, a consistent view of the portfolio, and a joined-up governance rhythm. Fragmentation shows up in inconsistent MI: underwriting reports one segmentation, IFRS 9 another, stress testing a third. Integration is the CRO's design task.
CRO and board implications Boards should be able to see credit risk in one place: underwriting quality, portfolio composition, provisioning trend, concentration profile, and stress outcomes. Where these disagree, the disagreement itself is the signal.
Practical implementation Credit policy owned by the credit function with CRO challenge; IFRS 9 governance with independent validation and overlay register; concentration limits with cascaded escalation; stress testing suite integrated with ICAAP; unified credit MI to the board risk committee.
Limitations Credit outcomes depend on macroeconomic conditions that cannot be forecast with precision. Governance manages the exposure; it does not remove the cycle.
Related reading See [Banking Risk](/expertise/banking-risk), [Model Risk](/expertise/model-risk), [Enterprise Risk](/expertise/enterprise-risk) and [Financial Risk](/expertise/market-liquidity).
Frequently asked questions
What should risk leaders know about underwriting standards?
Underwriting is the point at which credit risk enters the balance sheet. Standards should express the bank's credit appetite in operable rules: minimum affordability, collateral requirements, sector exposure, product structure, and treatment of exceptions. Exception management is a proxy for underwriting discipline; a high exception rate signals either mis-calibrated policy or weak enforcement.
What should risk leaders know about iFRS 9 provisioning?
IFRS 9 introduced forward-looking expected credit loss (ECL) provisioning. Its governance implications are material: models must be validated, macroeconomic scenarios approved, staging criteria monitored, and management overlays governed. Overlays are legitimate — no model captures every emerging risk — but they must be documented, time-limited and reviewed.
What should risk leaders know about concentration management?
Concentration risk is often the difference between a difficult year and a serious loss event. Governance should cover single-name, sector, geography and product concentrations, with limits that bind and MI that surfaces build-ups early. Concentration is not addressed by aggregation alone; correlation and contagion patterns matter.
What should risk leaders know about credit stress testing?
Credit stress testing feeds ICAAP, capital planning, appetite calibration and, increasingly, IFRS 9. The scenarios should be internally consistent (macro variables that co-move plausibly), sufficiently severe (to be decision-useful), and tied to the bank's actual portfolio composition rather than to a benchmark portfolio.
What should risk leaders know about integration?
The four disciplines should share a common taxonomy, a consistent view of the portfolio, and a joined-up governance rhythm. Fragmentation shows up in inconsistent MI: underwriting reports one segmentation, IFRS 9 another, stress testing a third. Integration is the CRO's design task.