Risk Management in Banking and Insurance · Credit Risk Management

Credit Risk Management Framework and Policy in Banks

Updated 11 October 2026 · Fact-checked

A credit risk management framework is the set of board-approved policies, structures, limits and processes a bank uses to identify, measure, approve, monitor and control credit risk. To answer exam questions, cover policy, organisation, approval and delegation, limits, monitoring and review, then apply them to the case given.

Understand Credit Risk Management Framework and Policy

Credit risk is the risk that a borrower or counterparty fails to pay as agreed. Lending is a bank's core business, so credit risk is usually its largest risk. A bank cannot remove it. It can only decide how much to take, from whom, and on what terms.

The credit policy is where this decision starts. The board of directors approves it, and it sets the bank's appetite for credit risk. A typical policy covers: target sectors and borrowers, sectors to avoid, minimum rating or appraisal standards, pricing principles, security and documentation requirements, exposure limits and review frequency. Management then turns the policy into procedures.

The organisational structure keeps the people who sell loans separate from the people who judge risk. The board, usually through a Risk Management Committee, oversees the whole. A Credit Risk Management Committee (or similar senior committee) handles policy and portfolio issues. An independent credit risk function sits apart from the business lines. This separation avoids the conflict where a relationship manager wants growth and ignores risk.

The credit approval process moves a proposal through appraisal, rating, sanction, documentation, disbursement and monitoring. Not every loan can go to the board, so delegation of powers gives sanctioning authority to officers and committees by loan size and risk grade. Bigger or riskier exposures go to higher authorities. Many banks use committee approval for larger loans so that no single person decides alone.

The credit risk management cycle is continuous: identify risk, measure it (rating, PD, LGD, EAD), set limits and price for it, approve and document, monitor and review, and recover or restructure if it turns weak. Findings go back to the board so the policy can be updated. Banks also set exposure norms and limits, such as caps on a single borrower, a borrower group, an industry or a geography, to avoid concentration. RBI prescribes regulatory exposure ceilings and expects banks to set tighter internal limits within them.

Key rules to remember

Expected loss: EL = PD × LGD × EAD; Used to price loans and set provisions; PD is probability of default, LGD is loss given default, EAD is exposure at default.
Exposure limit (percentage of capital): Maximum exposure = Limit % × Capital base; Use the capital base specified by the regulator or bank policy for the limit in the question; do not assume the percentage unless given.
Headroom under a limit: Headroom = Limit − Existing exposure; A new proposal is within limit only if proposed exposure ≤ headroom.
Portfolio share of a sector: Sector share = Sector exposure ÷ Total portfolio × 100; Compare with the internal sector cap to test concentration.

How to solve Credit Risk Management Framework and Policy questions

Use this order for any descriptive or case question on the framework and policy.

1Identify what is asked: policy content, structure, approval, delegation, limits or the full cycle.
2State the board's role: it approves the credit policy and sets risk appetite and oversight.
3Describe the structure: Risk Management Committee, credit committee, independent credit risk function, separation from business.
4Lay out the approval path: appraisal, rating, sanction at the right authority, documentation, disbursement, monitoring.
5Apply delegation: match the loan size and risk grade in the case to the authority level.
6Check limits: compute exposure against borrower, group, sector and regulatory caps, and flag any breach.
7Add monitoring and review: periodic review, early warning signals, feedback to policy.
8Close with a clear conclusion or recommendation tied to the facts given.

Quickest way: Policy, People, Process, Limits, Review

When to use it: Use for short answers and MCQs when you have two to three minutes.

Name the five heads: policy, people (structure), process (approval), limits, review.
Write one line under each, using the case facts.
For numbers, compute headroom = limit − existing exposure and compare with the proposal.
State the decision: approve, approve at higher authority, restructure the proposal, or decline.

Common mistakes in Credit Risk Management Framework and Policy

Saying management approves the credit policy.
Students confuse who frames procedures with who approves policy.
Fix: Write that the board approves the policy; management implements it through procedures.
Letting the business team rate and sanction its own loans.
Students think of a single lending officer and ignore independence.
Fix: Stress separation of the credit risk function from the business lines and the use of committee approval for larger loans.
Describing delegation without linking it to loan size and risk grade.
Students learn it as a definition only.
Fix: Say that higher amounts and weaker ratings go to higher authorities, and apply this to the case.
Treating the framework as a one-time approval step.
Focus stays on sanction and ignores what follows.
Fix: Present it as a cycle with monitoring, review and feedback into policy.
Ignoring concentration in limit problems.
Students check only the single borrower limit.
Fix: Test borrower, group and sector limits, and total against each cap.
Quoting RBI exposure percentages from memory without the base.
Numbers are recalled without the capital definition.
Fix: Use the percentage and base given in the question; otherwise describe the norm in words.

Worked examples

Example 1

A bank's board-approved policy caps exposure to any single industry at 20% of its total loan portfolio of ₹5,000 crore. Current exposure to the textile industry is ₹850 crore. A new textile proposal of ₹200 crore comes in. Can it be sanctioned within the sector limit, and what should the bank do?

Show the solution

Sector limit = 20% × ₹5,000 crore = ₹1,000 crore.
Headroom = ₹1,000 crore − ₹850 crore = ₹150 crore.
Proposal is ₹200 crore, which is more than ₹150 crore, so it exceeds headroom by ₹50 crore.
Exposure after sanction would be ₹1,050 crore, which is 21% of the ₹5,000 crore portfolio (taking the portfolio as unchanged for this test).
Under the framework, a limit breach cannot be sanctioned at the normal delegated level.

Answer: The proposal is not within the sector limit; it exceeds headroom by ₹50 crore. The bank should reduce the amount to ₹150 crore or less, arrange sell-down or participation for the balance, or refer the matter to the board or its designated committee for a documented exception, rather than sanction it under delegated powers.

Example 2

Explain the credit approval process and delegation of powers in a bank, and how they support sound credit risk management.

Show the solution

Start with the policy: the board approves the credit policy setting appetite, target segments and standards.
Appraisal: the proposal is assessed for borrower's financials, purpose, repayment source and security.
Rating: an internal rating is assigned by the credit risk function, independent of the business team.
Sanction: the proposal goes to the authority fixed by delegation, based on amount and risk grade; larger or riskier loans go to committees or the board.
Documentation and disbursement follow sanction, and conditions are checked before funds are released.
Monitoring: periodic review and early warning signals track the account, and findings feed back into policy.

Answer: The approval process moves a loan from appraisal and independent rating to sanction at the right authority, then documentation, disbursement and monitoring. Delegation of powers gives lower levels authority for small, lower-risk loans and sends large or weak-rated proposals to higher committees. This keeps decisions timely, avoids one-person decisions, ensures independence from sales targets and keeps the board informed of portfolio risk.

Exam tips

Case questions reward application: always use the amounts, ratings and names given before adding theory.
In limit problems, show limit, existing exposure, headroom and proposal in four clear lines, then conclude.
Name the board, the risk committee and the independent credit risk function; examiners look for who does what.
For long answers, use the credit risk cycle as your skeleton so you do not miss a stage.
In MCQs, watch for options that give policy approval to management or let the business team rate its own loans; these are wrong.

Practice questions from Credit Risk Management

Credit Risk Management Framework and Policy in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Credit Risk Management Framework and Policy: frequently asked questions

What is a credit policy in a bank?

It is a document approved by the board that sets the bank's appetite for credit risk and the rules for lending. It covers target sectors, appraisal standards, security, pricing, exposure limits and review. Management uses it to frame procedures.

Why is delegation of powers needed in credit sanction?

The board cannot approve every loan. Delegation lets officers and committees sanction loans within set limits based on amount and risk grade. Larger or riskier loans go higher, so control is kept while decisions stay timely.

Why must the credit risk function be independent?

Business teams are driven by growth targets and may underplay risk. An independent function rates and reviews credit objectively. This reduces conflict of interest and improves loan quality.

What are exposure norms and credit risk limits?

They are caps on how much a bank lends to a single borrower, a borrower group, an industry or a region. Regulators set ceilings, and banks set tighter internal limits within them. Their purpose is to prevent concentration.