Commercial loan risk rating matrix: how the grade is worked out

A commercial loan risk rating matrix is the form a bank uses to turn a borrower's numbers and a rater's judgements into one grade: a list of factors, a weight against each, a score for each factor, a weighted total and a guide that maps that total onto the scale. It looks like arithmetic and it is mostly policy. The weighted score is the easy half; the half that decides whether a grade survives a loan review or an examination is the override — who may move the grade away from what the matrix produced, by how many notches, and whether anyone wrote down why. Botminds' Risk Rating Validation re-runs the bank's own matrix over every rated commercial loan each night, so the gap between the score and the grade is a number somebody can look at rather than a line buried in a credit file.

The worked example below is fictional sample data from the solution: Kestrel Valley Bank, borrower Ridgeback Freight Lines, loan C-25-04417, $18.5 million. The bank's scorecard is its own and its weights are not published here; the rules and the research come from the agencies, from the Basel framework and from central-bank research, linked where they appear.

What a commercial loan risk rating matrix actually contains

Four parts, in order. A list of factors, which is the bank's theory of what makes a commercial borrower risky. A weight against each factor, which is the bank's view of how much each one matters. A scoring scale for each factor, so that a coverage ratio of 1.18x and a management assessment of "experienced, thin bench" both become numbers on the same footing. And a grade guide, which says that a weighted score in a given band is a grade 5, the next band a grade 6, and so on.

What the matrix does not contain is the grade. The grade is what comes out the other end, and at most banks it can be moved afterwards. That is not a flaw in the design; the agencies expect judgement to be in the system. The OCC's booklet asks that the criteria be written down: "The criteria for assigning each rating should be clear and precisely defined using objective (e.g., cash flow coverage, debt-to-worth, etc.) and subjective (e.g., the quality of management, willingness to repay, etc.) factors." Objective and subjective, in one sentence, with examples of both.

The 2020 interagency guidance on credit risk review systems asks for the same thing in the form of a document. An effective framework includes "a formal credit risk rating system in which the ratings reflect the risk of default and credit losses, and for which a written description of the credit risk framework is maintained, including a discussion of the factors used to assign appropriate risk ratings to individual loans". A matrix that exists only as a spreadsheet nobody has described in the policy is half a system.

The factors, and why they are a mix of ratios and opinions

Every working matrix has three kinds of factor, and only two of them are on the form. There are the measured factors, which come straight off the spread once the statements are on one basis. There are the judged factors, which the rater supplies and the bank's words define. And there are the factors the matrix cannot see at all — risks that are real, that the credit officer knows about, and that the version of the scorecard in force does not ask about.

The judged column is where the trouble lives, and it is worth being precise about why. A subjective factor is not a weakness in a rating system — a borrower's management, its willingness to pay and the quality of its reporting are real risks that no ratio captures. The weakness is a subjective factor with no written anchor. "Management: strong / adequate / weak" with nothing underneath it means that a lender who has known a family firm for a decade and an analyst who met them once will score it differently, and both will be sincere.

Where a bank runs two scales rather than one, some of these factors move house: the structure, the collateral and the guarantee belong to the facility grade rather than the borrower grade, which is the whole point of splitting the scale in two. On a single scale they all have to sit on the same form, and the matrix has to say how much any of them may move a grade.

The anchor is cheap to write and expensive to leave out. Two or three sentences per score point — what "strong management" looks like in terms of depth, succession, reporting discipline and track record through a downturn — turn an opinion into something a second rater can agree or disagree with for a reason.

Weights, the weighted score and the grade guide

Weights turn the factor list into a single number. Each factor is scored, each score is multiplied by its weight, and the products are added. The bank's own weights are its policy, and a good matrix publishes them to its raters: a weight that only the model owner knows cannot be argued with, and a factor whose weight nobody can state is a factor nobody can calibrate.

Two design decisions inside the grade guide do more work than people expect. The first is how wide each band is: narrow bands near the criticized line mean a small change in one ratio can move a loan across it, which is either early warning or noise depending on the book. The second is what happens at the boundary. Take a guide whose grade-6 band opens at 5.5, purely as an illustration: a weighted 5.6 is a grade 6 by a tenth of a point, and a bank that has not said whether the guide is read strictly will find its boundary cases decided by whoever is in the room.

How is a risk rating calculated, step by step on one borrower?

To calculate a commercial loan risk rating, put the statements on one basis, score each factor, weight and total the scores, read the total against the grade guide, then decide whether to accept that grade or override it — and write down which you did. The table below runs those steps on one fictional sample borrower, using only the figures the solution's screens show.

Steps one to five are reproducible. Any two people who follow them on the same statements get the same number, which is precisely why they are worth automating over a whole book rather than a sample. Step six is not reproducible, and is not meant to be: it is where a person takes responsibility for knowing something the form does not ask about. The entire quality of a rating system is in how step six is governed.

The override: the most important line on the form

An override is the rater's decision to grade a loan differently from the matrix's answer. Banks need them. A scorecard built on last year's factors will miss this year's risk, a borrower may have a guarantee the form cannot value, and a loan may be the only one of its kind in the book. The Basel framework's minimum requirements for internal ratings do not ban overrides; they demand that the bank say in advance when one is allowed.

For rating assignments based on expert judgement, banks must clearly articulate the situations in which bank officers may override the outputs of the rating process, including how and to what extent such overrides can be used and by whom.

Basel Framework, CRE36, minimum requirements for the IRB approach

Read the three conditions separately, because most override policies satisfy one and skip the others. In which situations — a list of the circumstances that justify moving away from the score, written before the case arises. How and to what extent — a cap, usually in notches, and usually different in the two directions, because an override that makes a loan look better is the one that costs money. By whom — a named authority, which is where a second signature belongs.

Then there is the requirement that is almost always missing: "Banks must identify overrides and separately track their performance." Overrides have to be countable and they have to be scored after the fact. A bank that cannot say how many of last year's upward overrides later defaulted has no evidence that its judgement is better than its own scorecard.

Reason codes, and what an unexplained override looks like a year later

A reason code is a one-word answer to "why is this grade not the one the matrix produced?" Its value is almost entirely retrospective. On the day, the rater knows exactly why; a year later, the rater has moved regions, the borrower's numbers have changed, and the only thing left is what was written down.

At the sample bank, 19 of 22 overrides in one region carried no reason code, and one of them — Ridgeback's two notches — was recorded as "none". That pattern is not a filing problem. It means the region's grades cannot be defended one at a time, because there is no stated basis to defend, and it means the override population cannot be scored, because there is nothing to group it by. When loan review downgraded five of the eighty-two Mountain-region grades it sampled last quarter, three of them were trucking loans.

What the write-up has to carry for the grade to stand

The matrix produces a number; the write-up is what makes the number a decision. The OCC's expectation is one sentence long: "The rating assigned to a credit should be well supported and documented in the credit file." What "well supported" means in practice is testable, and the sample bank tests it on five points, worth 100 between them: whether the write-up cites the ratios behind the grade, whether it addresses each weakness the scorecard found, whether it explains any override with a reason code, whether it uses current statements including the guarantor's, and whether it says what would move the grade.

Ridgeback's annual review fails four of the five. Coverage below the bank's guide is not explained. An 18% fall in earnings is not mentioned. The guarantor statement it relies on is from June 2024. The override is not explained at all. What it does carry is a relationship that began in 2014 and a sponsor with "substantial outside liquidity" — both true, neither of them an answer to why this borrower is two grades better than the scorecard says.

Risk Rating Validation: the scorecard, the override and the passages behind one grade

Why does the same matrix give different answers in two regions?

Because a matrix is applied by people, and the parts of it that are not arithmetic are read differently in different rooms. Treacy and Carey's survey of the fifty largest US banks put the point as a general property of the work, not a failing of any one bank: "the rating process almost always involves the exercise of human judgment because the factors considered in assigning a rating and the weight given each factor can differ" from one credit to the next.

Formalism is the usual answer, and it helps. The same study found that most banks required some written justification of the grade as part of the approval package, while a few used "forms or grids on which the rater identifies the relevant factors", and noted that "the stated motivation for such formalism is better consistency across asset types and geographic regions". The Basel framework turns the same idea into a requirement: grade descriptions and criteria must be detailed enough that raters "consistently assign the same grade to borrowers or facilities posing similar risk", and "this consistency should exist across lines of business, departments and geographic locations".

The word to notice is consistency, because it is a property of a population and not of a loan. No single credit file will ever show you that a region is a notch generous. You see it by taking borrowers who match on the measured factors, checking who graded them, and looking at the spread — which is what the sample bank's drift map does across nine industries and five regions, and what the definitions behind each grade have to survive.

Building a matrix two raters can use the same way

Start by writing anchors for every judged factor, because that is where the divergence is. Then publish the weights to the people who have to use them. Then cap the overrides, give them a short list of reason codes, and require a second signature past the cap — the sample bank's settings allow a co-signature on every override, one notch without one, or two, and the loosest of those three choices is the one that produces an unexplained population.

A second signature is the cheapest control in the list and the one most often waived under time pressure, so it belongs to a named seat rather than to whoever is available — which is the subject of who stands behind a grade.

Then do the part most banks skip: test the matrix before it goes into policy. Take fifty already-graded loans, re-score them with the proposed factors and weights, and look at where the new matrix disagrees with the grades on the book. Disagreements are not failures; they are the conversation. If the new matrix agrees with every existing grade, it has learned the bank's habits rather than its risk, and it will carry any drift already in the book into the next version.

Finally, keep the version in force and the version being tested apart, and say which one produced each grade. At the sample bank, scorecard v4.2 was approved in January 2026 and a v4.3 draft adding spot-rate exposure for truckload carriers is with model validation before use. Nothing is re-scored on the draft. That is the boring discipline that lets a credit officer answer the only question that matters at committee: which rules produced this number, and when were they approved?

Your credit policy: the tolerances, the caps and the memo minimum, as settings

Questions people ask

What factors go into a risk rating matrix?

Objective factors taken from the spread — debt service coverage, leverage, fixed charge coverage, liquidity, net worth and the earnings trend — and subjective factors supplied by the rater, such as the quality of management, willingness to repay, industry conditions and the quality of the borrower's reporting. The OCC's booklet names examples of both kinds and asks that the criteria for each grade be "clear and precisely defined" using them.

How are risk rating factors weighted?

By the bank, in its credit policy, and there is no regulatory weighting. Each factor's score is multiplied by its weight and the products are summed into one weighted score, which a grade guide maps onto the scale. What supervisors ask is not that the weights take particular values but that they be written down, applied consistently across regions and lines of business, and tested — a weight nobody can state is a weight nobody can calibrate.

Can a lender override the scorecard's grade?

Usually yes, within limits the bank sets in advance. The Basel framework requires a bank to "clearly articulate the situations in which bank officers may override the outputs of the rating process, including how and to what extent such overrides can be used and by whom", and to identify overrides and track their performance separately. Most banks cap the number of notches and require a credit officer's signature past the cap, with a tighter rule for overrides that improve the grade.

How much judgement is allowed in a risk rating?

As much as the policy says, and no more than can be explained. Judgement is expected: Treacy and Carey observed that the rating process "almost always involves the exercise of human judgment", because both the factors and their weight differ from credit to credit. The test is not whether a rater used judgement but whether the situation was one the policy anticipated, whether the move stayed inside the notch cap, and whether the reason is on the file.

What documentation does a risk rating need?

Enough that someone who was not in the room can follow it. The OCC asks that the rating "be well supported and documented in the credit file": the ratios the grade rests on, each weakness the scorecard identified and how it was addressed, any override with its reason code and evidence, the dates of the statements used including the guarantor's, and what would move the grade up or down from here.

What is a rating override reason code?

A code from a short fixed list that says why a grade differs from the scorecard's output — a verified guarantee, collateral the scorecard does not value, a data error, an industry factor the version in force does not ask about. The point of a fixed list rather than free text is that codes can be counted and scored: a bank can ask how its "verified guarantee" overrides performed over three years, and an override recorded as "none" cannot be defended or measured.