Credit Risk Management: Policies, Procedures, and Best Practices
7/3/2026
This post covers credit risk at the portfolio level — the policy, limits, authorities, and oversight that govern lending as a whole. Two companion posts handle the transaction level: our guide to commercial lending underwriting covers analyzing an individual credit, and the piece on problem loans covers what happens when one deteriorates.
The distinction matters because these fail differently. Individual credits fail from bad analysis. Portfolios fail from good analysis applied consistently to a concentration nobody limited.
Loan Policy as the Governing Document
Loan policy is where the board expresses its credit appetite, and it is either a working constraint or a document produced for examiners.
What belongs in it:
- Permitted loan types, and explicitly what the institution does not do
- Underwriting standards by type — minimum coverage, maximum loan-to-value, advance rates, guarantor requirements, and required financial reporting
- Approval authority by amount, type, and aggregate relationship exposure
- Portfolio limits by loan type, industry, geography, and single-borrower exposure
- Risk rating definitions with enough specificity that two officers rate the same credit the same way
- Exception policy — what constitutes an exception, who may approve one, and how exceptions are tracked and reported
- Appraisal and evaluation requirements
- Documentation standards
- Problem asset administration, including downgrade triggers and charge-off timing
The test of whether policy governs: does the institution decline loans because of it? A policy that has never produced a declination is describing what the bank does rather than constraining it.
Approval Authority
Authority should scale with exposure and be structured so that no individual can approve a credit large enough to matter alone.
Three design principles:
Aggregate, not individual, exposure determines the level. A borrower with four loans of $400,000 each is a $1.6 million relationship, and authority should key to the relationship.
Authority is not a seniority reward. It should reflect credit judgment demonstrated over time, and it should be reviewable — including downward.
Committee approval needs a real quorum and a recorded vote. A committee where the chief lender's view has never been overridden is a signature process rather than a committee.
Exceptions to policy are legitimate and should be approved at a higher level than the loan itself, tracked as a population, and reported. The exception rate by officer and by type is one of the most predictive metrics in credit administration — a rising exception rate precedes deterioration reliably.
Risk Rating Integrity
The rating system drives pricing, the allowance, regulatory reporting, and management's view of the portfolio. Its accuracy is therefore a financial statement matter, not an administrative one.
Where ratings degrade:
Ratings assigned at origination and never revisited until an annual review or a missed payment. Ratings should move when facts move — late financial statements, covenant breaches, deteriorating margins, or an industry event.
Optimism bias in the first line. A lender rating their own credits has an incentive to delay a downgrade, which is why rating authority should be reviewable by credit administration and tested by loan review.
Definitions too vague to apply consistently. If the difference between a 4 and a 5 rating is not written down in testable terms, the portfolio's rating distribution reflects officer temperament rather than credit quality.
Downgrades treated as a failure. Where a lender is penalized for downgrading, downgrades stop happening and losses arrive without warning. This is a cultural problem with a financial consequence.
Portfolio Limits
Limits are the control that individual underwriting cannot provide, because each credit can be sound while the aggregate is not.
Set limits by loan type, industry, geography, collateral type, single borrower and related interests, and individual officer portfolio where relevant. Express them against capital rather than against total loans, since capital is what absorbs the loss.
Two practices distinguish limits that work:
Tiered escalation rather than a single ceiling. A limit with a monitoring threshold below it — additional reporting at 80 percent, board approval required above 100 percent — gives management time to act rather than presenting a breach as a surprise.
Limits that have actually constrained something. A limit set well above any plausible exposure is decorative. The useful test is whether any limit has ever caused the institution to decline or restructure business.
Commercial real estate deserves specific attention because interagency guidance sets out concentration levels that trigger heightened risk management expectations, and because CRE concentration has preceded a disproportionate share of bank failures.
Loan Review
Loan review provides the independent assessment of credit quality, rating accuracy, and policy compliance across the portfolio.
Independence is the first requirement: loan review reports to the board or audit committee, not to the chief lending officer whose portfolio it assesses. A review function inside lending is self-assessment.
Scope should cover a meaningful proportion of the portfolio by dollar and by count, weighted toward larger exposures, criticized credits, exceptions, and newer officers' portfolios. It should also include a sample of pass-rated credits — reviewing only the problems tells you nothing about whether the ratings are right.
Findings should address rating accuracy specifically, since a review that confirms documentation while accepting management's ratings has skipped the substantive question.
Where loan review is outsourced, the same independence and scope expectations apply, and the institution should read the report critically rather than filing it.
Portfolio Reporting
Reporting that lets a board govern credit answers five questions:
Where are we against our limits, by type, industry, and geography, with trend.
How is the rating distribution moving? Migration analysis — how many credits moved between rating categories, in which direction — is more informative than a static distribution.
What is the exception population, by type and by officer, and is it growing?
What are past due, nonaccrual, and criticized balances, with trend and with the largest individual exposures named.
What is the allowance, and does it reconcile to the ratings? If ratings deteriorated and the allowance did not move, one of the two is wrong.
Reporting should include the credits management is worried about but has not yet downgraded. That list is the most useful page in a credit package and the one most often omitted.
Stress Testing the Portfolio
Community banks are not required to run large-bank stress tests, and a proportionate exercise is still valuable.
Useful scenarios: a significant decline in commercial real estate values; a rise in unemployment in the institution's own market; the failure of the largest employer in the primary trade area; a rate environment that pressures borrowers with variable-rate exposure; and the loss of the single largest borrower relationship.
The output should be an estimate of losses and capital impact, and a statement of what management would do — which is the part that makes it planning rather than arithmetic.
Structured coverage is available through the Certificate in Financial and Credit Risk Management, Credit Risk Management: Managing, Monitoring, and Measuring, and Credit Risk Management: Commercial and Agricultural Lending.
The Cultural Question
Every structural control above can be present and ineffective if the institution's culture penalizes credit discipline.
The observable indicators are specific. Are downgrades treated as information or as failure? Has the credit function's objection ever changed an outcome? Do lenders bring difficult credits forward early, or after the problem is undeniable? Is the exception rate discussed, or only the production number?
The clearest signal is what happens to a lender who declines a marginal deal that a competitor books. In institutions where that lender is supported, credit discipline survives a growth cycle. In institutions where they are asked why they lost the relationship, the policy is a document and the portfolio will demonstrate it two years later.
This is why credit risk management is a board-level topic rather than a departmental one. The structure is management's to build; the tone that determines whether it functions is the board's to set.
Growth Periods Are When Credit Risk Is Created
Credit losses appear in downturns and are created in expansions, which is the most important timing fact in portfolio management and the least reflected in how institutions govern.
The mechanism is straightforward. In a strong market, competition compresses pricing and loosens structure. Borrowers have options, and the institution that insists on a coverage cushion, a personal guarantee, or a shorter amortization loses the deal to one that does not. Loan demand is strong, production targets are being met, and every individual concession looks reasonable against the alternative of losing a relationship. Two or three years later the portfolio contains a cohort of credits underwritten to standards nobody formally changed.
Four controls address this specifically, and all of them work better when installed before they are needed.
Track structural drift, not just volume. Report the distribution of key terms by origination vintage — coverage ratios, loan-to-value, guarantor coverage, amortization periods, and covenant packages. A shift in the median is visible in this report a year before it is visible in delinquency.
Monitor exception rates as a leading indicator. A rising exception rate in a strong market is the clearest available signal that policy is being negotiated rather than applied.
Compare pricing to risk rating. If newly originated credits at a given rating are pricing below the prior year's equivalents, the institution is accepting the same risk for less return, which is a decision someone should make consciously.
Review declined deals that competitors booked. Not to second-guess the declination, but to understand what the market is doing and whether the institution's standards remain viable or have become uncompetitive for reasons worth examining.
The board's role here is narrow and decisive: ask, during good years, whether underwriting standards have changed. Management will usually answer that policy is unchanged, which is generally true and beside the point. The follow-up worth asking is what the vintage reports show.
A final structural note on where credit administration should sit. The function that maintains rating integrity, tracks exceptions, and administers policy needs to be independent of production, and at a community institution that rarely means a large department — it means one experienced person who does not report to the chief lending officer and whose objection carries weight. Institutions that fold credit administration into lending for efficiency reasons generally get efficiency, and they also get a rating distribution and an exception population that reflect what the lending function is comfortable disclosing. The reporting line is a small organizational decision with a disproportionate effect on whether every control described above actually functions.
Frequently Asked Questions
What belongs in a bank's loan policy?
Permitted and prohibited loan types, underwriting standards by type, approval authority by amount and aggregate relationship exposure, portfolio limits by type and industry and geography, risk rating definitions specific enough to apply consistently, exception policy with tracking and reporting, appraisal and documentation requirements, and problem asset administration including downgrade triggers.
How should credit approval authority be structured?
Scaled to aggregate relationship exposure rather than individual loan amount, assigned on demonstrated credit judgment rather than seniority, reviewable including downward, and structured so no individual can approve a credit large enough to matter alone. Exceptions should be approved at a higher level than the loan itself and tracked as a population.
Why do risk ratings degrade over time?
Because they are assigned at origination and revisited only at annual review, because lenders rating their own credits have an incentive to delay downgrades, because rating definitions are often too vague to apply consistently, and because institutions that treat downgrades as failure stop receiving them. Rating accuracy is a financial statement matter, since ratings drive the allowance.
How should portfolio limits be set?
Against capital rather than total loans, since capital absorbs the loss, and with tiered escalation — a monitoring threshold below the ceiling — so management can act before a breach. Limits should cover loan type, industry, geography, collateral, and single borrower with related interests. A limit that has never constrained anything is decorative.
What makes loan review effective?
Independence from lending, with reporting to the board or audit committee rather than to the chief lending officer. Scope weighted toward larger exposures, criticized credits, exceptions, and newer officers — but including a sample of pass-rated credits, since reviewing only problems reveals nothing about whether ratings are accurate. Findings must address rating accuracy, not just documentation.
What is the most useful page in a credit report to the board?
The list of credits management is concerned about but has not yet downgraded. It is the earliest available view of where the portfolio is heading, and it is the page most often omitted — which is itself informative about whether the institution reports bad news before it becomes unavoidable.
