Credit Risk Modelling & Scorecards

Credit risk models estimate the chance a borrower won't repay. They decide who gets a loan, how much and at what price, so they are among the most regulated models in any bank. This lesson covers PD/LGD/EAD, scorecards with WoE and IV, and how ML fits in.

The building blocks

• PD (probability of default): the chance of default (e.g. 90+ days past due) within a horizon, usually 12 months.
• LGD (loss given default): the share of the exposure lost if default happens, after recoveries and collateral.
• EAD (exposure at default): how much is owed at the time of default (credit cards: the current balance plus expected further drawdown).
• Expected loss = PD × LGD × EAD. It drives pricing, provisioning (IFRS 9 / Ind AS 109 expected-credit-loss) and capital.

Classic scorecard workflow

1. Define the target: "bad" = 90+ DPD within 12 months of the application; exclude indeterminate cases.
2. Binning: split each variable into bins with monotonic bad rates (e.g. age, income, utilisation).
3. Weight of Evidence: for each bin, WoE = ln(%good / %bad).
4. Information Value: IV = Σ (%good − %bad) × WoE. A common rule of thumb is < 0.02 useless, 0.02–0.1 weak, 0.1–0.3 medium, > 0.3 strong (and check for leakage if suspiciously high).
5. Logistic regression on the WoE-transformed variables.
6. Scaling to points: score = offset + factor × ln(odds), often "20 points to double the odds" (PDO).

import numpy as np, pandas as pd
def woe_iv(df, col, target="bad", bins=5):
    d = df[[col, target]].copy(); d["bin"] = pd.qcut(d[col], bins, duplicates="drop")
    g = d.groupby("bin", observed=True)[target].agg(["sum", "count"]); g["good"] = g["count"] - g["sum"]
    g["pg"] = (g.good + .5) / g.good.sum(); g["pb"] = (g["sum"] + .5) / g["sum"].sum()
    g["woe"] = np.log(g.pg / g.pb); iv = ((g.pg - g.pb) * g.woe).sum()
    return g[["count", "sum", "woe"]], iv

Where gradient boosting fits

• GBMs often beat scorecards on AUC/KS, especially with alternative data (transactions, bureau trends).
• Requirements make them usable:
• Monotonic constraints: e.g. higher utilisation must never lower risk.
• SHAP-based reason codes: "declined because of high utilisation and recent missed payments".
• Stability testing and documentation for validators.
• Common hybrid: a GBM for ranking, plus a scorecard-style explanation layer, or a challenger model run alongside the champion.

Evaluation for credit models

• Discrimination: AUC/Gini (Gini = 2·AUC − 1) and the KS statistic.
• Calibration: predicted vs observed bad rate by score band.
• Stability: PSI (population stability index) of the score and features over time; PSI > 0.25 is a common "investigate" threshold.
• Vintage analysis: bad rates by origination month, to see how cohorts mature.
• Reject inference: you only observe outcomes for approved applicants. Techniques such as parcelling or augmentation reduce that bias.

Fairness and regulation

• Avoid protected attributes and proxies for them; test outcomes across groups.
• Give adverse-action reasons to declined customers where regulation requires.
• Follow the full governance cycle: documentation, independent validation, monitoring, periodic recalibration.

Check yourself