How CreditRisk+ Algorithms Turn Loan Portfolios into Loss Distributions: Poisson Defaults, Gamma Sector Factors, Exposure Bands, Recursions and Tail-Risk Failure

Reader question: A bank may have thousands of loans, each with its own probability of default and loss amount. How can an algorithm estimate the distribution of total portfolio loss without simulating every borrower path millions of times?

CreditRisk+ answers this with an actuarial construction. It models credit losses as discrete default events, approximates default counts with Poisson distributions, groups loss amounts into exposure bands, and introduces common sector factors to create default dependence. The portfolio loss distribution can then be recovered from probability-generating functions and recursive numerical algorithms rather than full Monte Carlo simulation.

The model was published by Credit Suisse First Boston in 1997 as an open credit-risk framework. Its computational attraction is speed and transparency. Its central limitation is equally important: it is a default-mode model. It does not attempt to model the continuous mark-to-market effects of rating migration in the way CreditMetrics-style approaches do.

What this page owns — and what it does not

This page owns the transformation:

PDs + exposures + LGDs + sector-factor assumptions → discrete portfolio loss distribution → tail-risk measures.

It does not replace Gaussian-copula credit portfolio modelling, which owns latent-normal-factor joint-default construction; credit-rating transition matrices, which own migration-state dynamics; or Basel IRB capital algorithms, which apply a separate regulatory capital formula.

This is public portfolio-risk mathematics. It is not a credit decision on any borrower and not personalized financial advice.

Start with obligor-level expected loss

For obligor A, define:

• EAD_A = exposure at default;
• PD_A = probability of default over the horizon;
• LGD_A = loss fraction if default occurs.

A deterministic loss amount on default is:

L_A = EAD_A × LGD_A.

Expected portfolio loss is then:

EL = Σ PD_AL_A.

That calculation is easy. The hard problem is the distribution around the mean: how much loss can occur in a bad year when many obligors default together?

Bernoulli default versus Poisson approximation

A single borrower can default at most once during the horizon, so the natural indicator is Bernoulli:

D_A ∈ {0,1}, P(D_A=1)=PD_A.

CreditRisk+ replaces the individual Bernoulli construction with a Poisson approximation:

N_A ~ Poisson(μ_A)

with:

μ_A ≈ PD_A.

For small PD, the probability of two or more Poisson “defaults” for one obligor is very small, so the approximation is computationally convenient.

This approximation should not be hidden. At high PDs or for very concentrated exposures, the difference between Bernoulli and Poisson behaviour can become material.

The independent-default generating function

Suppose losses are measured in an integer loss unit L₀. Obligor A’s default loss is represented by:

v_A = round(L_A/L₀)

loss units.

For independent Poisson default counts, the probability-generating function of total loss in loss-unit space can be written:

G(z) = exp[Σ μ_A(z^v_A − 1)].

When this power series is expanded:

G(z) = Σ p_n zⁿ,

the coefficient p_n is the probability that portfolio loss equals approximately:

n × L₀.

This is the key computational trick: the entire loss distribution is encoded in the coefficients of one generating function.

Why exposure bands are needed

Loan losses are not naturally integer multiples of one common amount. A portfolio might contain losses of 7,430, 218,500 and 3,912,800.

CreditRisk+ discretises the exposure space so that each loss is represented by an integer number of loss units. This turns an irregular continuous monetary problem into a discrete convolution problem that recursive algorithms can solve efficiently.

The smaller the loss unit, the more accurate the exposure representation—but the longer the loss grid and the greater the computational cost.

Discretisation is a model approximation

Suppose a 104 loss is rounded to one 100-unit band. The model records 100 rather than 104. Across thousands of positions, those differences can accumulate.

A robust implementation therefore tests several loss-unit sizes and checks whether:

• expected loss remains close to the direct obligor sum;
• tail quantiles are stable;
• runtime and memory remain practical.

Grid choice is an explicit accuracy-versus-speed trade-off.

Independent defaults are not enough

If every obligor defaulted independently at a fixed PD, portfolio tail loss would usually be too thin for many real credit books.

Defaults cluster because borrowers share economic drivers:

• recession;
• commodity-price shocks;
• property cycles;
• industry stress;
• regional shocks;
• financial-system stress.

CreditRisk+ introduces common risk factors by allowing default intensities themselves to vary randomly.

Gamma-mixed sector intensities

Consider a sector factor X_k with:

E[X_k] = 1.

The factor can be Gamma distributed so that its variance controls how unstable the sector default rate is through time.

Conditional on the factor, obligors can remain Poisson independent. Their conditional intensities rise when the sector factor is high and fall when it is low.

After integrating over the random Gamma factor, the default-count distribution becomes a mixed Poisson distribution with heavier tails. A Gamma–Poisson mixture produces negative-binomial-type behaviour, giving analytically tractable default clustering.

Why common factors create default correlation

Suppose two firms share the same cyclical sector factor.

Conditional on a calm factor realization, both have low default intensity. Conditional on a stressed realization, both have high default intensity.

Even if the defaults are conditionally independent given the factor, they are positively dependent unconditionally because both respond to the same random environment.

This is CreditRisk+’s alternative to specifying a full pairwise default-correlation matrix.

Multiple sectors

A portfolio can use factors such as:

• global economy;
• country;
• industry;
• commercial real estate;
• energy;
• consumer credit.

An obligor can be assigned wholly to one sector or, in extensions, loaded across several factors.

The sector design is not a harmless classification exercise. If two strongly related borrowers are placed in independent sectors, the model can understate joint loss. If unrelated borrowers are forced into one high-volatility sector, tail dependence can be overstated.

Sector-factor variance drives tail thickness

If the factor variance approaches zero, the sector intensity becomes nearly deterministic and the model approaches the independent-Poisson case.

As sector-factor variance increases, bad states with unusually high default intensity become more likely. Portfolio variance and high-loss tail probabilities increase.

This parameter therefore deserves the same validation attention as PD and LGD. Tail capital can be highly sensitive to a sector-volatility estimate that looks like a secondary calibration input.

The recursive computation

The generating function can be expanded coefficient by coefficient. The original CreditRisk+ framework advocated actuarial recursion techniques, while later research proposed numerically stable alternatives based on power-series expansions.

Conceptually, the algorithm does:

1. choose loss unit L₀;
2. map every obligor loss to an integer band;
3. aggregate expected default intensity by band and sector;
4. construct the portfolio generating function;
5. recursively compute coefficients p₀, p₁, …;
6. accumulate the CDF;
7. read expected loss, quantiles, tail loss and risk contributions from the distribution.

No scenario simulation is required for the baseline analytical distribution.

Why numerical stability still matters

“Analytical” does not mean “numerically automatic.”

Large portfolios can create long power series with coefficients spanning many orders of magnitude. A recursion can accumulate rounding error, cancellation or underflow.

Haaf, Reiß and Schoenmakers published an alternative numerically stable CreditRisk+ recursion and explicitly compared it with the Panjer-style recursion associated with the original framework.

A production implementation should therefore test probability conservation and compare at least one independent numerical method.

Probability conservation

The computed discrete distribution must satisfy:

p_n ≥ 0

and:

Σ p_n ≈ 1.

Negative probabilities or a probability mass of 0.997 after truncation are not “model uncertainty.” They are numerical or grid failures unless an explicitly quantified tail truncation explains the missing mass.

Expected-loss round trip

The distribution’s mean should reconcile to the direct obligor-level expected loss, adjusted only for known discretisation effects:

Σ p_n(nL₀) ≈ Σ PD_AL_A.

This is one of the strongest implementation diagnostics because it connects the complex portfolio distribution back to a simple independent calculation.

From loss distribution to VaR

For confidence level q, credit-loss VaR is the smallest loss ℓ such that:

P(L ≤ ℓ) ≥ q.

If economic capital is defined relative to expected loss:

EC_q = VaR_q − EL

under that chosen convention.

The model supplies the distribution. The institution still has to define which risk measure, horizon and confidence level are appropriate for its use case.

Expected shortfall

Expected shortfall considers the average loss in the tail beyond a chosen quantile rather than only the quantile threshold.

CreditRisk+ loss distributions can support ES calculations and risk contributions as well as VaR. Haaf and Tasche developed analytical risk-contribution methods for CreditRisk+, including extensions to expected shortfall.

Large single-name concentration is a weak point

Poisson approximation works most naturally when individual default probabilities are low and the portfolio contains many exposures.

Imagine one borrower represents 25% of portfolio loss. A “multiple-count” Poisson approximation for that borrower is conceptually awkward because the same name cannot default twice during the horizon.

A concentrated portfolio should therefore be benchmarked against an exact Bernoulli or Monte Carlo representation for its largest names.

Recovery is often simplified

Baseline CreditRisk+ implementations commonly use deterministic loss severity:

L_A = EAD × LGD.

Real recoveries are uncertain and can be correlated with default rates. Recoveries can fall during systemic stress.

Extensions can add stochastic exposure or recovery, but doing so changes the simple baseline model. If deterministic LGD is used, the limitation should be visible in the tail-risk interpretation.

No mark-to-market migration

A BBB bond downgraded to B but not defaulting creates no credit event in a pure CreditRisk+ default-mode model.

Its market value may fall materially, but that loss is outside the model unless the exposure/loss definition has been expanded.

This is a clean ownership boundary with rating-transition models.

Inputs and outputs

A robust CreditRisk+ engine can require:

• obligor identifier;
• PD;
• EAD;
• LGD or recovery assumption;
• loss unit;
• sector assignment or factor weights;
• sector expected default rate;
• sector-factor variance;
• calculation horizon;
• distribution truncation point;
• recursion algorithm and numerical precision.

Outputs can include the full discrete loss distribution, EL, variance/unexpected loss, VaR, expected shortfall, sector contributions, obligor contributions, probability-conservation diagnostics and grid-sensitivity results.

Evidence polarity: what supports confidence?

Evidence for confidence includes a loss-distribution mean that reconciles to direct expected loss, probability mass summing to one, stable tail quantiles across finer loss units, sector variances supported by observed default-rate variability, sensible concentration response, and close agreement with an independent Monte Carlo benchmark under the same assumptions.

Evidence against confidence includes quantiles that move materially when the loss unit is halved, sector assignments that dominate capital without economic rationale, high-PD names treated as if the Poisson approximation were exact, tail probabilities sensitive to arbitrary distribution truncation, or large unexplained differences from simulation.

Counterexample: same expected loss, different tail loss

Portfolio A and Portfolio B can have identical:

Σ PD × EAD × LGD.

But if Portfolio A is diversified across many sectors and Portfolio B is concentrated in one volatile sector, their 99.9% loss quantiles can differ dramatically.

Expected loss therefore cannot substitute for a portfolio dependence model.

Counterexample: same pairwise correlation, different tail structure

A Gaussian-copula model and a Gamma-mixed Poisson model can be calibrated to similar low-order dependence and still generate different extreme-loss tails.

Risk cannot be reduced to one “correlation number.” The factor distribution and default-event construction matter.

Counterexample: a smaller loss unit does not fix wrong sector dependence

Reducing discretisation error can make the numerical distribution extremely precise while the economic dependence assumptions remain wrong.

Numerical convergence is evidence that the code solves the chosen model, not evidence that the model describes the world.

Counterexample: a zero historical default count does not imply zero PD

Low-default portfolios often contain rating/sector cells with no observed defaults in a short sample.

If the engine converts that directly to PD = 0, the entire exposure disappears from modeled credit loss. Smoothing, external data, conservative floors or Bayesian estimation may be needed, depending on the model’s governance framework.

Weak links in implementation

Exposure-unit error. Dollars and thousands of dollars are mixed before banding.

Loss-unit coarseness. Tail quantiles are grid artifacts.

PD/Poisson misuse. High PD is treated as a perfect Poisson approximation.

Sector-factor miscalibration. Historical default-rate variance includes changing portfolio composition but is interpreted as pure systematic risk.

Sector independence assumption. Energy and industrial sectors are modeled as independent even though both respond to the same macro shock.

Deterministic recovery. Downturn recovery risk is absent.

Truncated distribution. The loss grid stops before all relevant tail probability has been captured.

Numerical recursion instability. Coefficient errors appear in deep tails while central moments still look plausible.

Diagnostics: how to test the engine

• probability test: require all coefficients non-negative and total mass near one.
• expected-loss round trip: compare the distribution mean with ΣPD×EAD×LGD.
• loss-unit convergence: halve the band unit repeatedly and test EL/VaR/ES stability.
• independent simulation: run Monte Carlo under the same Poisson/Gamma assumptions and compare the CDF.
• zero-factor-variance test: sector dependence should collapse toward the fixed-intensity Poisson case.
• single-sector stress: increase one factor variance and verify losses rise mainly through names exposed to that sector.
• concentration test: replace many small loans with one large exposure of equal EL and inspect tail change.
• Bernoulli benchmark: compare the Poisson approximation for high-PD or large names with exact Bernoulli simulation.
• truncation test: extend the loss grid and verify tail quantiles no longer move.
• recovery stress: apply lower LGDs/recoveries under stress and measure the limitation of deterministic severity.

What would falsify confidence?

Confidence should be withdrawn if the loss distribution does not preserve probability; if expected loss fails to reconcile; if tail quantiles are unstable under reasonable grid refinements; if the model materially understates a Bernoulli benchmark for concentrated/high-PD names; if sector-factor estimates cannot be reproduced; or if repeated realized stress losses fall in regions the model assigns implausibly tiny probability without a credible regime explanation.

Alternatives

Gaussian-copula models build joint default from latent correlated asset variables and can incorporate a richer correlation matrix, but their tail dependence has its own limitations.

CreditMetrics-style migration models include rating changes and mark-to-market value movement, not only default.

Monte Carlo intensity models can handle more complex dependence, stochastic recovery and path features, at higher computational cost.

Structural models link default to firm asset value and capital structure.

CreditRisk+ remains useful because its assumptions are visible and its full portfolio distribution can be computed quickly without hiding the mechanics inside a massive simulation engine.

How this connects to the surrounding knowledge estate

Obligor PDs can be informed by rating-transition evidence. CreditRisk+ then aggregates those marginal risks using an actuarial Poisson–Gamma dependence structure, while Gaussian-copula models provide a different joint-loss architecture. Regulatory capital uses a separate Basel IRB mapping. Comparing the three exposes which parts of portfolio credit risk come from marginal PD, dependence, severity, horizon and regulatory design.

Verification and update triggers

Preserve the PD snapshot, exposure/LGD data, loss unit, sector map, sector-factor variances, horizon, recursion method, distribution cut-off and numerical precision. Revalidate after portfolio-mix shifts, recession/default waves, sector remapping, recovery-model changes, PD redevelopment, concentration changes, numerical-library migrations or persistent discrepancies against independently simulated loss distributions.

Primary and high-quality references

• Credit Suisse First Boston, CreditRisk+: A Credit Risk Management Framework, 1997 — the original published framework.
• Tom Wilde, CreditRisk+, Wiley major reference work, summarising the model’s actuarial and analytical structure.
• Michael Gordy, A Comparative Anatomy of Credit Risk Models, Journal of Banking & Finance, comparing CreditRisk+ and other portfolio models.
• Haaf, Reiß and Schoenmakers, Numerically Stable Computation of Credit Risk+, Journal of Risk.
• IMF, working-paper application of CreditRisk+, providing a public institutional example of the model used for bank portfolio loss analysis.

Educational boundary: This article explains portfolio credit-loss mathematics. It does not estimate the creditworthiness of any named borrower, set bank capital or provide personalized financial advice.