Credit Risk Rating: How Banks Grade a Commercial Loan

A credit risk rating is the grade a bank assigns to a loan to summarize how likely the borrower is to repay and how much risk the exposure carries. Examiners and the bank's own credit policy both run on this number: it drives loan pricing, the allowance for credit losses, portfolio reporting, and how closely the relationship gets watched. Most US banks map every commercial credit to the regulatory scale, Pass, Special Mention, Substandard, Doubtful and Loss, after spreading the borrower's financials and weighing the 5 Cs of credit. This guide walks through how the rating is built, what each grade means, and where credit teams cut the slow part of the work.

What is a credit risk rating?

A credit risk rating is a standardized grade a lender assigns to a loan or borrower that reflects the probability of default and the likely loss if default happens. It turns a pile of financial analysis into one comparable score so the bank can price the loan, set its loss reserve, and report the health of the portfolio. The rating is not a credit score pulled from a bureau; it is the bank's own judgment, built from the borrower's financial statements, tax returns, bank-statement cash flow and the qualitative picture, then assigned on a defined scale.

How do banks assign a credit risk rating?

Banks assign a credit risk rating by spreading the borrower's financials, calculating coverage and leverage ratios, weighing the qualitative 5 Cs of credit, and mapping the result to a defined grade. The analyst pulls revenue, expenses, assets and liabilities off the tax returns and financial statements, rebuilds cash flow from the bank statements, computes debt service coverage and leverage, then scores the borrower against the bank's rating criteria. Two banks can run different scales, but the inputs are the same: documented cash flow, balance-sheet strength, collateral, management and the broader conditions the business operates in.

What is the credit risk rating scale?

Most US banks rate commercial credits on the regulatory classification scale published by the OCC, FDIC and Federal Reserve. Pass and Special Mention are unclassified; Substandard, Doubtful and Loss are the adverse classifications examiners track. Many banks layer a finer internal scale (often 1 to 9 or 1 to 10) on top, so several internal grades roll up into a single Pass category, but every internal grade still maps to one of the five regulatory buckets.

Source: OCC Comptroller's Handbook, Rating Credit Risk; FDIC Uniform Credit Classification; Federal Reserve guidance.

What factors determine the rating?

The rating comes out of the same analysis that drives the credit decision: the 5 Cs of credit, applied to documented numbers, the same framework behind how banks underwrite a commercial borrower. Capacity (can the cash flow service the debt), capital (how much the owner has at risk), collateral (what secures the loan), character (track record and management) and conditions (industry and economic environment) each push the grade up or down. The quantitative side leans on a few ratios, and the rating reflects where the borrower lands against the bank's benchmarks. Our guide to the financial ratios used in credit analysis covers how each one is calculated and read.

The exact thresholds belong to each bank's credit policy. What matters is that the rating is defensible: every number traces back to a document, and a reviewer or examiner can see why the grade is what it is. For the mechanics behind the coverage figure, see our guide to the debt service coverage ratio, and for the combined business-plus-guarantor view, global cash flow analysis.

What is the difference between a risk rating and a credit score?

A credit score is a bureau-generated number (FICO, business credit scores) that predicts repayment from a borrower's credit history. A risk rating is the bank's own grade for a specific loan, built from the borrower's full financial picture, the collateral, and the structure of the facility. A business can have a strong owner credit score and still earn a Substandard rating if its cash flow does not cover the debt. The score is one input; the rating is the conclusion the bank stands behind.

How often is a credit risk rating reviewed?

Banks re-rate credits on a schedule and whenever something material changes. Most run an annual review for performing commercial loans, with larger or weaker credits reviewed more often, and an immediate downgrade when a borrower misses payments, breaches a covenant or posts deteriorating financials. The point of the watch grade, Special Mention, is to catch a slide early so the loan can be re-rated before it becomes a classified asset. Keeping ratings current is exactly what examiners test, and stale ratings are a common criticism in an independent loan review, the separate credit risk review function that re-tests each rating; the financial re-analysis behind it is what loan review software automates.

How can analysts speed up credit risk rating?

The slow part of rating a loan is not the judgment; it is the data entry that comes first. Spreading tax returns and financial statements and rebuilding cash flow from bank statements can take 30 to 60 minutes per borrower before the analyst forms an opinion, and a single transposed figure flows straight into the grade. Pulling the line items automatically removes that bottleneck and the transcription risk. Credit analysis software reads the returns, financials and bank statements, extracts every figure, and computes the cash flow, debt service coverage and leverage the rating turns on, with each value traceable to its source so a reviewer verifies instead of re-keys. The analyst spends the time on the credit judgment, not on building the spread. The same output feeds financial spreading software and the broader loan underwriting software workflow.

Once a credit is graded and approved, the file still has to come together. Many teams export the borrower's statements to a clean workpaper with a bank statement to Excel converter, set up tracking for the borrower's insurance as a closing condition with certificate of insurance tracking software, and get the approved facility executed through an online document e-signing tool. Each step sits downstream of the rating, so the grade stays the focus and the rest is mechanical.

Frequently asked questions

What does a Substandard rating mean for a borrower?

A Substandard rating means the loan has a well-defined weakness that jeopardizes repayment, usually weak cash flow or thin collateral coverage. It is the first of the three adverse classifications, so the bank will watch the credit closely, may raise pricing or tighten terms at renewal, and carries a larger loss reserve against it. It does not mean default, but it signals the bank sees real risk.

Who assigns the credit risk rating at a bank?

The credit analyst or underwriter assigns the initial rating during analysis, and it is confirmed through the bank's approval chain, often a credit officer, a committee, or both for larger exposures. Independent loan review and the bank's examiners then test whether the assigned ratings are accurate and consistent. The rating is a controlled number, not one person's opinion.

Can credit risk rating be automated?

The data work behind a rating can be automated; the grade itself stays a credit judgment. Software extracts the financials and bank statements and computes the coverage and leverage ratios automatically, so the analyst applies the bank's rating criteria to clean, traceable numbers instead of building the spread by hand. That removes the slow, error-prone keying while leaving the decision with the credit team.