Credit Risk for Financial Firms
-
40 Minutes -
For all staff
-
Global
A loan that looks safe can become a loss. This in-depth IIRSM-accredited compliance course helps staff at global financial firms understand credit risk as part of wider financial risk, and how the Basel Committee expects it to be managed. Credit risk arises wherever a firm is owed money: mortgages, credit cards and corporate loans, but also trading activities, interbank transactions, bonds and credit derivatives. Default risk, recovery rate and credit ratings show how likely a loss is and how large it could be, while interest rates and leverage can make it worse.
Meanwhile, solvency ratios, capitalisation ratios and coverage ratios show whether the firm can absorb losses. Credit risk management sets risk appetite and governance, backed by preventive, detective and corrective controls, risk self-assessments and credit risk reporting. When a credit event such as bankruptcy or receivership occurs, contingency planning and lessons learnt feed continual improvement.
What you’ll learn in
this course
- Understand what credit risk is, including its sub-types
- Quantify and calculate credit risk
- Recognise who manages credit risk within a company
- Learn how to manage credit risk by identifying, assessing, treating, monitoring and reporting it
- Recognise the importance of continual improvement for credit risk management
Hear from our customers
Feefo Customer Rating ★★★★★ 4.9/5
Operational Risk
Leaders will explore how operational risk is defined and how organisations identify, assess and monitor risks. The course covers risk assessments and indicators, controls, scenario analysis and the different approaches available for managing risk, including mitigation, transfer and acceptance.
Developing Secure Applications
Vulnerabilities introduced in development are the cheapest to fix and the most expensive to ignore. Security testing at the end of a pipeline finds what is already built. For firms subject to DORA, NIS2 or supplier security assessments, evidence that development teams are trained in secure practice is increasingly requested directly, not inferred from your policy set.
Business Travel Risk
Duty of care does not pause at the airport. Employers remain responsible for staff safety abroad, and that responsibility is tested when something goes wrong in a location where support is thin. Briefing travellers properly before departure is far cheaper than managing an incident remotely, and it gives your organisation a documented position on how it discharges that duty.
Risk Identification
Risk identification is the first step in the Management of Risk (MoR) framework, and this in-depth IIRSM-accredited course helps global staff do it well. Clearly describing a risk event, its causes and consequences makes it easier to assess and treat. Risk categories help organise what you find: financial risk, strategic risk, operational risk and external risk have their own sources, and fraud risk needs particular attention. Identification draws on many sources. Historical data shows what’s gone wrong before, while SWOT analysis and PESTLE analysis look at the company and its environment. Scenario analysis explores what might happen next, and the Delphi technique and brainstorming gather views from people who know the work, using group communication techniques to keep discussion fair and focused. Finally, findings go into the risk register (which feeds risk reporting), backed by risk documentation, risk audits and a clear view of common risk challenges.
Cyber Risk
Cyber risk is a business-wide issue that can quickly halt operations, expose customer data and draw regulatory attention. This in-depth IIRSM-accredited course helps global staff understand cyber risk and play their part in risk management. Start with the threat landscape. Cyberattack trends show phishing, ransomware and denial-of-service attacks growing more sophisticated, while AI threats make deepfake scams more convincing. State-sponsored cyberattacks and supply chain attacks add pressure, and remote work vulnerabilities give attackers more ways in. Employee negligence remains a common cause of data breaches. Then comes the response. Cyber governance sets accountability, and cloud security and third-party risks need careful oversight, supported by cyber risk due diligence. Business continuity planning and operational resilience testing keep a firm running when something goes wrong, while regulatory expectations such as DORA and GDPR compliance shape how incidents are handled.
Risk Assessment
This in-depth IIRSM-accredited compliance course helps global staff understand risk assessment as a clear, repeatable process, from spotting a risk to deciding what to do about it. Risk categories help: financial risk, operational risk, strategic risk and external risk behave differently. Each is rated by probability, impact and proximity, then plotted on a risk matrix or risk heat map to give a risk score. Inherent risk exists before controls, and residual risk remains once they’re applied. Next comes the decision. Risk evaluation compares the score with your organisation’s risk appetite and risk tolerance, and a risk threshold shows when action’s needed. Risk treatment, risk mitigation and risk control follow, supported by risk monitoring and risk documentation. Finally, advanced tools, such as risk models, Monte Carlo simulations, probability trees, sensitivity analysis and expected monetary value (EMV), put numbers on uncertainty.
Risk Management
Risk registers age badly when they belong to one team. Organisations that manage risk well are the ones where operational staff escalate early because they know what the framework does with the information. Spreading that understanding wide enough is the difference between a risk framework that informs decisions and one that merely documents them after the fact.
The Three Lines of Defence
Effective risk management depends on everyone understanding their role in identifying, managing and overseeing risk. This 45-minute course explains how the model works in practice, helping learners understand risk ownership, accountability and the responsibilities of each line within a risk management framework. Team members will explore the roles of operational teams and how these groups work together to support governance and effective risk oversight. The course also covers reporting, key risk indicators, independent assurance and the importance of maintaining clear accountability across the organisation. Strengthen risk culture, improve collaboration and ensure risks are managed, monitored and escalated effectively.
Continual Improvement of Risk Management
A static risk management framework will stop working effectively. This in-depth IIRSM-accredited course helps global staff understand how firms keep improving the way they manage risk, in line with the Management of Risk (MoR) approach. Improvement starts with the cycle itself. Risk identification, risk assessment, risk treatment, risk monitoring and risk reporting offer evidence of what’s working (and not). A positive risk culture, clear risk ownership and genuine collaboration make evidence easier to act on, and the lessons learnt process turns incidents and near misses into change. Governance keeps it honest. The three lines of defence (3LOD) divide the work, internal audit tests it, and the board and senior management carry final responsibility for meeting compliance obligations. Process maturity models and capability maturity models show how far the organisation has come. Cyber risk, phishing attacks and third-party risk show why standing still isn’t an option.
Credit Risk for Non-Financial Firms
Investments in bonds, equities, crypto assets and foreign exchange transactions add exposure, as do ESG financial risks. Credit risk management sets risk appetite and puts controls in place: preventative, detective, directive and corrective. Internal audits, risk and control self-assessments (RCSA), reporting and monitoring show whether they work. Business continuity and lessons learned exercises keep the firm resilient and improving.
Credit Risk for Financial Firms
Meanwhile, solvency ratios, capitalisation ratios and coverage ratios show whether the firm can absorb losses. Credit risk management sets risk appetite and governance, backed by preventive, detective and corrective controls, risk self-assessments and credit risk reporting. When a credit event such as bankruptcy or receivership occurs, contingency planning and lessons learnt feed continual improvement.
Risk Monitoring
Risk registers describe the world as it was on the day someone last reviewed them. Between reviews, exposures move and controls degrade quietly. Building monitoring awareness across the business means changes get noticed by the people closest to them rather than at the next quarterly cycle, which is usually the difference between managing a risk and reporting an incident.
Risk Reporting
Boards make decisions on what reaches them, and what reaches them depends on people at the operational level judging what is worth reporting. Poor input cannot be corrected further up the chain. Training staff on what good risk reporting looks like improves the raw material, which does more for governance quality than another layer of review ever will.
Risk Treatment
Treatment decisions are where risk management either earns its place or becomes an overhead. Controls added without weighing cost against benefit slow the business and rarely get followed. Teaching staff to think in terms of proportionate response produces a control environment people actually use, and gives internal audit something more useful to test than whether a control exists.
Risk Appetite
A risk appetite statement approved by the board and unknown to the business achieves nothing. Appetite only functions when the people making operational decisions can tell whether a proposal sits inside it. This course pushes that understanding down to where the decisions happen, which is the difference between appetite as governance language and appetite as a working constraint.
Business Continuity Management
Some disruptions are unavoidable. Being unprepared for them is not. Our Business Continuity Management Training explains how to identify and analyse risks, develop effective continuity plans and prepare for disaster recovery. Equip employees with the knowledge to respond confidently under pressure, minimise disruption and help protect essential business activities. This in-depth compliance course supports a more resilient organisation, helping teams turn continuity plans into practical action.
Physical and Personal Security Risk
A door propped open, an unchallenged visitor or a colleague working alone late at night can turn a ‘normal’ day into an incident. This in-depth IIRSM-accredited course helps global staff understand physical security and personal security risks and how to minimise them. Start with the building. A risk assessment highlights weak points, from perimeter security to common areas and restricted areas. Access control, such as swipe cards and identification passes, keeps the ‘wrong’ people out, and visitor identification shows who’s on site. Alarm systems, CCTV and security teams provide the next layer. Then consider the people. Employee safety depends on violence prevention, aggression prevention and conflict resolution skills, and lone working needs particular care. Terrorism risk and threats from protests call for clear emergency procedures; incident reporting shows what went wrong, and security policies can be updated so it doesn’t happen again.
Third-Party Risk
Most companies depend on external suppliers, and if they have an issue, it can quickly become a problem for you. This in-depth IIRSM-accredited course helps global staff understand third-party risk management (TPRM) throughout the risk lifecycle. It begins before any contract is signed. Risk appetite sets how much outsourcing dependence a firm will accept, and due diligence tests whether a supplier can meet it. Contract negotiation builds in performance benchmarks, data privacy duties and a termination strategy supported by exit plans. Once a supplier is live, ongoing monitoring tracks performance and spots problems early. Concentration risk, nth parties and cloud outsourcing can hide dependencies that are easy to miss. Operational risk, reputational risk and compliance risk follow, so a governance framework and business continuity planning keep the organisation resilient. In financial services, anti-money laundering (AML) expectations apply to suppliers too.
Introduction to Risk
Start with the basics. Hazards and threats can cause harm, while risk opportunities can deliver positive outcomes, which is why positive and negative risk exist. A risk event has causes and consequences, and its risk impact and likelihood decide how seriously it should be treated. Risk perception matters too, because people judge the same risk differently. It’s sorted into risk categories: financial risk, operational risk, strategic risk and external risk. Modern examples include cybersecurity, market abuse, climate change and supply chain risk. Business continuity and health and safety show how risks affect people and operations, and ethical responsibility reminds everyone that managing risk is part of doing the right thing.