Credit rating agencies multi-firm review: Insights into surveillance, methodologies and internal controls

This multi-firm review focuses on the surveillance processes, credit rating methodologies and internal controls for UK-registered credit rating agencies (CRAs).

1. Summary

Surveillance of existing ratings is a key regulatory priority for CRAs. In line with our 2024 portfolio letter[1] and 2026 Regulatory Priorities report[2], we expect CRAs to ensure the quality of credit ratings on an ongoing basis through an effective surveillance process.

Any weaknesses or biases in methodologies or their application may impair the ratings’ integrity, making them less reliable as independent indicators of creditworthiness.

Our findings are based on a sample of firms and involved:

analysis of scoped information provided by CRAs including rating and control review files
analysis of internal procedures of CRAs
engagement with analytical and control functions of CRAs
review of regulatory notifications, and
ongoing supervisory work

Our aim is to reinforce existing regulatory expectations rather than introduce new ones, highlighting good practices and areas for improvement.

2. Who this applies to

These findings apply to UK-registered CRAs. They may also be relevant to those who use credit ratings or engage with CRAs such as issuers, investors, intermediaries, trade associations and regulatory bodies.

3. What firms need to do

UK-registered CRAs should review these findings, evaluate their processes and controls under Board oversight, and consider if gap analysis and remediation are necessary.

4. Why we did this work

Assigning a rating is only the starting point. CRAs must demonstrate sustained analytical quality and oversight after the initial rating assignment. Weaknesses in surveillance, methodologies or internal controls increase the risk that ratings may not reflect credit conditions in a timely manner, leading to incorrect or unexpected rating actions, undermining market confidence.

Through this review, we aimed to understand how CRAs maintain robust arrangements for ratings surveillance, consistent application and ongoing review of methodologies, and effective internal controls under the UK Credit Rating Agencies Regulation (UK CRAR).

Specifically:

Article 8(5) requires ongoing monitoring of ratings, including the impact of changes in macroeconomic and financial market conditions, with annual reviews representing the minimum regulatory standard when there are no earlier indications of material changes that could have an impact on a credit rating.
Article 8(3) requires methodologies to be rigorous, systematic, continuous and subject to validation based on historical experience, including back-testing.
Article 6(4) and Annex I require governance, documentation, resourcing and three lines of defence controls to ensure ratings remain high quality and independent throughout their lifecycle.

We expect CRAs to maintain comprehensive internal records and disclose adequate rationales for rating actions, including environmental, social, and governance (ESG) factors.

This review also touches on considerations relating to transparency and disclosure of ESG factors in methodologies, covered in the annex at the end.

Given technological developments in CRAs, the use of AI and models can enhance surveillance through earlier risk detection and improved consistency, if accompanied by effective governance to manage risks, biases and ensure analytical challenge.

5. Surveillance: What we found

Surveillance consists of ongoing monitoring and an annual review of the rating. CRAs have a continuous obligation to maintain the quality and independence of ratings over time, and the annual review is the minimum regulatory requirement. To ensure that the annual review is a robust and meaningful component of the surveillance process, the governance, resourcing and controls for the annual review are expected to be at least equivalent to those for new ratings.

5.1. Purpose: Governance of surveillance process

Surveillance ensures that ratings reflect all available and relevant information, including changes in macroeconomic and financial conditions. Therefore, CRAs must ensure effective governance of the ongoing monitoring and annual review of all ratings (six-monthly for sovereigns).

Good practices observed

Structured frameworks for ongoing monitoring: To meet the requirement of ongoing monitoring across the rating lifecycle, some firms conduct frequent monitoring (monthly or quarterly) supported by structured top-down and bottom-up information flows. Certain CRAs apply detailed sector-wide frameworks with defined triggers and thresholds as well as use thematic and macroeconomic forums, all of which support effective monitoring.
Robust annual review practices: To meet the annual review requirement under the UK CRAR, some firms used a full rating committee review at the individual rating level for all existing ratings, similar to the initial rating process, to ensure an equivalent depth of analysis.
Positive culture for early error detection: Some firms demonstrated a positive culture for self-reporting, where performance frameworks supported early error detection by recognising and reinforcing self-identification of errors by first line analysts.

Areas for improvement

Unclear ongoing monitoring frameworks and practices: Some firms’ surveillance frameworks were unclear. They lacked detailed policies, terms of reference and defined responsibilities for the ongoing monitoring of existing ratings. This may have resulted in inconsistent depth of analysis and delayed surveillance. Analysts’ discretion on skipping certain model runs or rating factor reviews may lead to suboptimal surveillance outcomes like abrupt transitions and lags in error identification.
Weak interpretation of annual review expectations: Some firms did not recognise that the annual review is expected to be equivalent in quality and transparency to the initial rating assignment. CRAs vary in how they interpret and apply the annual review under the UK CRAR, and some should consider how their arrangements meet the above expectation. For instance, some CRAs relied on light touch, prioritised surveillance approaches (through portfolio, sector or thematic reviews), which meant individual ratings were not reviewed by a full rating committee for several years. Bulk or batch rating committees (committees where multiple rating decisions are taken) lacked sufficient governance to ensure robust discussions and challenge at the individual rating level.
Complex and fragmented error frameworks: Error frameworks were sometimes narrow, fragmented or subjective, which could lead to errors being misidentified, misclassified, or not detected early enough. Materiality thresholds, contrary to Article 8(7), may prevent the full scale of errors from being reported and escalated to the Boards.

5.2. People: Capability, capacity and roles of people responsible for surveillance

Surveillance analysts and approvers involved in the annual review are expected to have the equivalent seniority and experience as those responsible for the initial rating. All staff participating in the ongoing monitoring process are expected to be subject to robust independence safeguards to prevent conflicts of interest. The surveillance analyst should engage appropriately with rated entities, to ensure any material developments are considered.

Good practices observed

Dedicated roles and responsibilities: Some CRAs had dedicated surveillance teams for complex or high-volume portfolios so they could apply the same depth of analysis as the initial ratings while also meeting timeliness expectations of ongoing monitoring.
Independent and credible challenge at surveillance committees: Certain CRAs had policies to ensure attendance of sufficient senior analytical staff and independent experts for methodologies and models, enabling effective challenge at surveillance rating committees.

Areas for improvement

Insufficient evidence on analytical capability expectations: Some CRAs did not use the rating committee process to meet the annual review requirement. In those scenarios, they should consider how annual review arrangements meet the equivalent expectations of analysts’ and approvers’ seniority and experience.
Insufficient evidence on analytical capacity management: Certain firms were not able to provide evidence of how they monitored capacity pressures and analyst workloads in relation to surveillance alongside new ratings and other activities. Where analysts were responsible for both new and existing ratings, the competing priorities of new business risked undermining the timeliness and quality of surveillance. CRAs should consider how they ensure clear visibility over analytical resourcing, in light of surveillance responsibilities for analysts and approvers.
Insufficient evidence of inputs from rated entities: For certain CRAs that used portfolio reviews, prioritisation or filtering processes for surveillance, we did not see clear evidence of analyst engagement with rated entities to ensure appropriate inputs.

5.3. Process: How the surveillance process works

The surveillance process must include ongoing monitoring with a well-documented annual review and transparent disclosure of rating actions. Annual reviews are expected to consider all relevant and available information, changes in assumptions, and the application of all aspects required by the methodology, including models and criteria. Controls for annual reviews of ratings are expected to be as strong as those used for initial ratings, and documented adequately to ensure quality and independent ratings.

CRAs must promptly notify us when they identify any error in a rating methodology or its application, regardless of a rating change. CRAs should have robust and transparent error identification processes, conduct root cause analysis with remediation plans, and ensure that Board oversight of the scope of errors is not limited.

Good practices observed

Defined continuous monitoring system: To escalate individual ratings for committee review earlier than the annual review cycle, certain firms track possible fundamental and macro factors through various practices such as monthly or quarterly performance reviews, portfolio reviews, early warning indicators, event-driven reviews, or asset class, sector, thematic forums. Some used technology to monitor ratings against pre-defined triggers or thresholds and established processes for proactively engaging with issuers to clarify ongoing information requirements.
Effective implementation of annual review: Some firms ensured that each rating was subject to a full rating committee at least annually, supported by well-resourced committees that provided challenge, alongside detailed documentation and committee minutes.
Lookback reviews for enhancements: Certain firms had processes to ensure lookback reviews for any significant rating transitions or errors, and to identify root cause and remediation, including improvements to the surveillance process or changes to the relevant methodologies.
Transparent rating disclosure procedures: Some firms had effective processes to ensure ratings were accurately reflected in all circumstances (such as downgrades, withdrawals), including engagement to address issuer challenge. This supports market transparency.

Areas for improvement

Absence of procedures and systems for ongoing monitoring: Many firms lacked defined processes or guidance to ensure ongoing monitoring of ratings went beyond the minimum requirement of annual reviews. For ongoing monitoring between annual reviews, we did not find documentation to evidence first line control activities, which raises concerns about effectiveness of ongoing surveillance.
Weak systems and controls for annual review: Some firms relied on analyst-led reviews instead of formal rating committees, or applied optional or abbreviated rating committee processes. In such cases, we could not see evidence of sufficient challenge, methodology application checks, or comparable controls to initial ratings, which could impact ratings quality.
Inappropriate use of exceptions to annual review: Certain firms had exemption policies which allowed their compliance teams to grant exceptions to the annual review process or publications required at the end of annual review. They did not notify us of these under the required regulatory submissions.
Insufficient first line controls, including documentation: We found low-quality documentation, with committee minutes and addenda often lacking detail on challenge, decision rationales, and divergences from methodologies or model outputs. This undermined auditability and second and third line oversight. First line quality checks were frequently checklist based and did not provide substantive assessment of analytical judgement or application of methodologies. In addition, oversight of linked entity or linked transaction ratings was limited, with committees sometimes bypassed by relying on precedent decisions.
Weak error procedures including disclosures: Our desk-based reviews identified many instances of long lags in identification of errors in case of certain CRAs. Error identification lags which exceed one year raise concerns about the quality of the annual review process. Most firms relied heavily on first line teams to identify errors, while second and third line functions often lacked sufficient methodology expertise or review scope to detect errors independently, increasing reliance on first line controls. We also observed selective transparency, with errors having neutral or positive rating impacts disclosed more clearly than those with negative impacts.

6. Credit rating methodologies and their application: What we found

Methodologies are fundamental to the assignment of credit ratings. Methodologies are inclusive of all their components such as models, key rating assumptions and criteria. Given the inherent risk of conflicts of interest in the CRA business model, good governance of methodology development, review and approval is critical.

CRAs should mitigate the risk of commercial influence through effective conflicts of interest controls. There should be clear separation between commercial and analytical functions, independent oversight, and defined accountability in the methodology process. Further, methodologies must be applied consistently to both initial ratings and subsequent rating actions.

6.1. Purpose: Governance of methodology process and application

Methodologies provide a structured framework within which analytical judgement is applied, with sufficient detail to support consistent rating outcomes across analysts and rating committees.

Analysts are expected to apply methodologies systematically, clearly justifying, documenting and disclosing any exceptions or divergences.

To ensure methodologies remain independent and reflective of current and evolving risk factors, they should be subject to ongoing monitoring and reviewed annually by the independent review function (IRF). Firms should regularly report review findings and outcomes to their Board.

Good practices observed

Good understanding of expectations: Most firms generally demonstrated a sound understanding of regulatory expectations for the annual review of all components of methodologies. Some established pre-set standards so model design and approval occurred independently.
Established framework for divergences: Some CRAs had well-defined frameworks distinguishing material and non-material deviations, variations or exceptions in methodologies and models. These frameworks included guidance on classification, documentation, approval and record-keeping – supporting transparency and consistent application of methodologies.
IRF regularly engaging with Board and independent non-executive directors (INEDs): We observed good governance in certain instances where the IRF held standing agenda slots at Board meetings and maintained regular bilateral engagement with INEDs. In certain instances, we saw evidence of meaningful INED inputs in methodology review and approval.

Areas for improvement

Limited depth and coverage of annual methodology review: Some firms did not review key components of methodologies (including models, variables and assumptions) annually. Instead, they applied risk-tiered cycles of 3-5 years, or conducted high-level or limited scope annual reviews, with more comprehensive reviews deferred to longer cycles. These approaches undermine the effectiveness of the annual review.
Unclear model inventory and coverage: In some firms, the scope of what constituted a ‘model’ was unclear, with various tools used in the ratings process (such as spreadsheets and formulas) not consistently identified or governed as models. There was also limited evidence that all model types were subject to annual review as part of methodology oversight, which could limit the comprehensiveness of methodology reviews.
Weak governance of divergences: In some firms, policies permitted adjustments within methodologies or models (such as tolerable deviations or variations) which were not formally documented or monitored, with only out-of-tolerance deviations recorded. This meant that methodology performance monitoring was incomplete, as not all deviations, variations or exceptions taken from the methodology were reviewed as part of the annual review process.

6.2. People: Capability, capacity and roles of people involved in methodologies process and application

INEDs are expected to independently monitor the development of credit rating methodologies, the effective management of conflicts of interest and the operation of the review function. Development and review functions are expected to be staffed with appropriately skilled personnel, including expertise in required areas (such as modelling, back-testing) and clearly segregated from commercial activities to prevent conflicts of interest.

Good practices observed

Expert capabilities within methodology development team: Many CRAs demonstrated deep analytical and modelling expertise among their model development staff, helping inform methodology and criteria design.
Dedicated methodology staff: Many CRAs had dedicated methodology and model development teams separate from rating analysts, further mitigating conflicts of interest.
Active engagement of Board: In some CRAs, Boards proactively asked for deep dive reviews of certain instances of rating transitions or methodology updates to better understand the root cause of significant transitions, and fit and appropriateness of methodologies.

Areas for improvement

Lack of segregation of roles and responsibilities: For some CRAs, IRF staff participated in methodology and model development committees, even where their role was advisory, which blurred boundaries between oversight and development. Also, in some CRAs where methodology developers participate and vote in approval committees (though not in majority), CRAs need to ensure evidence of effective challenge in approval decisions.
Limited role of INEDs: We saw a variety of engagement models for INEDs in the methodology review role, ranging from pre-request for comment (RFC) involvement in some CRAs to post-RFC review in others. INEDs should consider whether relying on formal attestations alone is sufficient to discharge their role in overseeing processes to manage conflicts of interest, particularly in relation to methodology development and review.

6.3. Process: How the methodology process and application controls work

The IRF should independently validate and review credit rating methodologies, models and key rating assumptions, and play a central role in their approval. The development and review processes should reinforce independence and effective challenge. Methodologies need to be applied systematically and any objective reasons to vary from them should be appropriately documented and reviewed.

Good practices observed

IRF executing review and validation tests: We observed that in certain CRAs, the IRF independently conducted the required performance and validation tests, ensuring that methodology performance assessments are done independently from the first line.
Clear assessment of factors driving methodology change: We saw that for certain CRAs, there was a clear assessment of the factors driving the methodology change to check for potential commercial conflicts of interest.

Areas for improvement

Lack of independent execution of review and validation tests: In some firms, first line staff undertook performance and validation testing, with the IRF’s role limited to reviewing results which could affect independent assessment and challenge. We also observed selective use of assumptions and data filters in performance studies by first line staff, which could weaken the robustness and credibility of validation.
Poor documentation of methodology and model divergences: In our review of rating files, we saw instances of missing documentation of divergences (deviations, variations or exceptions) from methodologies or models, inadequate justifications and sometimes even missing disclosures in press releases.
Absent feedback loop into methodology review process: There was no centralised tracking or repository of divergences (deviations, variations or exceptions), to feed back into methodology review cycles. This could limit the effectiveness of second and third line reviews.
Weak oversight of third-party models: Where third-party models were used, validation and back-testing controls were weaker than for internal models. Certain firms relied on external validation, creating vulnerabilities in outsourced analytical components.

7. Internal controls and oversight of the rating committee, surveillance process and methodologies: What we found

Second and third line controls should independently evaluate the adequacy and effectiveness of first line controls and processes to provide assurance on transparency and quality of ratings as well as effective mitigation of any conflicts of interest. Further, given that each CRA’s business differs in nature, scale and complexity, we expect internal controls to be proportionate and effectively resourced to independently deliver robust oversight and quality assurance.

7.1. Compliance

In the context of this MFW, the compliance function is responsible for independently monitoring adherence to regulatory obligations relating to the ratings and surveillance process, and methodologies and models.

It should identify and assess risks of non-compliance and provide guidance to analytical staff. Compliance should be independent, sufficiently resourced and skilled, with the ability to escalate issues to the Board. Compliance should ensure that errors and breaches for all ratings relevant to the UK (issued and endorsed) are notified to us.

Good practices observed

Comprehensive reporting to Board and INED: A number of firms demonstrated good compliance oversight, with direct access to the Board, INEDs or other governing forums. We saw evidence of regular and escalated reporting on rating transitions, exceptions, errors, appeals, surveillance trends, sector-level risks, and analytical capacity.
Strong capability and expertise: At many firms, compliance staff showed a strong understanding of the rating and methodology process, enhancing the quality of oversight with their direct knowledge.
Direct observation of rating committees: To complement the compliance review of rating committee adherence to procedures, compliance staff attended rating committees on a periodic basis to observe actual practices.
Remuneration structures supporting independence of control functions: Remuneration structure for control functions, including compliance, were designed to be free from business or financial performance considerations to avoid commercial conflicts, supporting the independence and effectiveness of all lines of defence.

Areas for improvement

Lack of independent reporting and resolution: We noticed instances where reporting lines of compliance could compromise independence of this function. We also observed weaknesses in how compliance and risk-related matters were resolved between compliance and first line, leading to ineffective oversight outcomes.
Limited oversight of control design: In many cases, compliance did not have a substantial role in overseeing the design of first line controls which would improve alignment with regulatory expectations. For some firms, areas which could benefit from more compliance input include error definition, identification and reporting, methodology application controls (deviation, variations and exceptions), rating committee controls and surveillance policies.
Procedural monitoring and limited depth of review: For most firms, commercial interest and conflict of interest checks were limited to verifying reporting lines, voting rights, remuneration structure and attestations only, with no content-based review of the methodology development, review and approval committees' documentation. For certain CRAs, compliance did not review the effectiveness of the annual review process design, particularly when no rating committee was involved.
Weaknesses in regulatory reporting practices: We saw instances of firms applying materiality filters before reporting errors and breaches, resulting in regulatory underreporting. In our analysis of regulatory returns, we observed repeated instances of delayed or bulk regulatory reporting, where it should be timely and continuous. We also expect to see continued improvement in the quality of reporting to include sufficient details on root-cause and impact analysis in case of errors and breaches.

7.2. Review

The second line review function or IRF is expected to operate as an independent, technically proficient control layer. It validates and reviews all credit rating methodologies, models and key rating assumptions on an ongoing basis and at least annually. IRF needs to be fully separate from the firm’s analytical and commercial activities, with independent reporting from the first line.

Good practices observed

Strong capability: Some firms demonstrated high-quality independent oversight by placing individuals with deep analytical expertise in the IRF, strengthening challenge credibility.
Direct observation of rating committees: In some cases, we noted that IRF staff periodically attended rating committees as observers to get a firsthand opinion of the nature of discussions and challenge. This was in addition to carrying out the ex-post review of rating action files or committee packs.
Comprehensive scope of work: In certain CRAs, the IRF, as part of its methodology review role, conducted high‑quality, in‑depth qualitative reviews of rating committee documentation. These reviews went beyond checklist‑based assessments and included testing the consistent application of methodologies, model inputs and the completeness of evidence presented to committee. Reviews also looked at divergences from methodology or model outputs, and documentation of rationales. In some cases, there was evidence that the IRF tracked error themes, root causes, and systemic issues, independently escalating them to the Board, all of which would strengthen oversight.

Areas for improvement

Limited role of the IRF: In certain firms, we observed that IRF did not carry out their own independent validation and testing, but instead relied on first line to execute the tests. IRF should consider developing their analytical expertise to ensure independent delivery of their role. For many firms, divergences from methodologies or model outputs were not consistently considered during the methodology review process.
Lack of depth of work: At some firms, where methodology review role consisted of reviewing rating files, we observed a lack of sufficient depth and consistency. For example, we saw procedural checklist testing rather than substantive assessments of analytical quality and consistent methodology application. In terms of sample selection, review coverage varied across portfolios, asset classes and geographies (including UK) without adequate rationale which could reduce the effectiveness of oversight.

7.3. Risk management

Risk management should identify, assess and monitor risks relevant to the obligations under the UK CRAR, including those affecting the quality, continuity, and independence of rating and surveillance activities. Risk management should ensure that such risks are properly reported by the relevant functions. Risk management should escalate emerging risks to the Board, including those that could impair quality and independence of new and existing ratings.

Good practices observed

Comprehensive scope of work: In some firms, risk management contributed by reviewing enterprise-level risks, including analytical capacity strains, delays in surveillance, and root causes of rating transitions. These reviews helped firms understand the operational vulnerabilities that could affect rating quality.
Independent reporting line: For most CRAs we engaged, there was an independent reporting line for risk management that reinforced influence and oversight.

Areas for improvement

Lack of independent challenge by risk function: We saw limited evidence of risk management challenging the first line in their assessment of risks relating to rating quality, methodology application, capacity pressures and surveillance processes. There was a lack of independent identification of risks if not identified by the first line itself, especially those arising from commercial influences, long error identification lags, or inconsistent methodology application.
Insufficient capability and understanding: In certain CRAs, we observed that the risk function had limited exposure to first line activities, including through periodic attendance at rating committees, which could impact effective delivery of their role.

7.4. Internal audit

Internal audit should provide independent and objective assurance on the effective operations and controls for the rating process and methodologies.

We expect the audit function to issue recommendations to management and formally track remediation for any deficiencies in rating committee processes, annual review, and first and second line controls. Audit should provide regular reports to the INEDs or audit committee of the Board.

Good practices observed

Comprehensive scope and work plan: Some audit teams independently reviewed analytical resource adequacy, tested first line controls, the effectiveness of second line control functions, as well as methodology and model governance.
Strong analytical capability: Some firms put individuals with deep analytical experience in the third line roles, strengthening challenge credibility. We also noted audit staff periodically attending rating committees to get firsthand exposure to first line practices and complement the review of rating committee procedures.
Quality oversight over IRF governance framework: At some CRAs, audit function produced focused reports covering IRF resourcing, capacity and governance along with examining methodology committee structures, consistent treatment of material methodology changes and oversight of related impacts on outstanding ratings.

Areas for improvement

Resourcing not proportionate to scale and complexity: We observed a wide range of resourcing models ranging from a small, outsourced team to large global internal audit teams. For some CRAs, the audit function was not adequately staffed in proportion to the scale and complexity of their business.
Limited scope and depth of audit of first line controls: For certain CRAs, audit functions did not review surveillance process design and effectiveness, particularly when no rating committee was involved. Across CRAs, the audit function varied significantly in the depth of their reviews. For example, checks for rating committees were procedural rather than substance driven and did not include the quality of committee challenge or the consistent application of methodologies.
Insufficient depth of audit of second line controls: In many cases, audit function had limited oversight of the annual methodology review coverage, adequacy of model validation cycles, and the extent of all material and non-material divergences from methodology and models. Lack of evaluation of second line effectiveness could lead to oversight deficiencies not appropriately remediated.

8. Next steps

Firms should reflect on how these findings apply to their business and consider adopting relevant examples of good practice as well as addressing any areas for improvement.

We will continue to engage with the firms and may undertake spot checks which may include targeted reviews of rating actions, methodologies, or internal control outputs.

9. Annex: ESG factors in credit rating methodologies and surveillance

We expect CRAs to be transparent in how they consider ESG factors and disclose them in their methodologies and rating actions.

Transparency of methodologies: We observed variations in how firms considered ESG factors in their published methodologies. Firms should be clear in the purpose of their published materials and articulate whether a methodology addresses ESG factors as analytical inputs or explanatory outputs. This would support transparency for users and align with firms’ disclosure obligations.
Consistency of ESG factors: From reviewing files and discussing with firms, we identified inconsistency in how they were classifying and documenting ESG factors. For some CRAs, governance factors were sometimes treated as ESG factors, and at other times considered within broader credit risk analysis. Such inconsistency could reduce clarity for users of credit ratings when reviewing published rating action rationales.
Application of ESG factors: Firms differed in how they were applying ESG factors during surveillance. A small number of firms’ methodologies included criteria for when to treat ESG factors as credit relevant, but others told us they relied more heavily on analytical judgement. To ensure consistent application, firms should consider how ESG factors are incorporated in their frameworks.
Consideration of ESG factors: Most firms could describe at what stage ESG factors were considered within their surveillance process, for example before or during a rating committee. For some CRAs, we observed that internal documentation lacked clarity on the impact and materiality of environmental and social factors in determining a rating action. This may limit transparency for users in rating action rationales, where a specific ESG factor may be credit relevant.
Ongoing monitoring of ESG risks: Our review of files and discussions indicated that firms had varying approaches to surveillance of ESG risks (such as near-term or long-term, materiality, impact). Where ESG risks are assessed to be potentially credit material but may emerge over longer time horizons, firms should consider the ability of their surveillance including people and processes, to effectively monitor such risks.

Share

1. Summary

2. Who this applies to

3. What firms need to do

4. Why we did this work

5. Surveillance: What we found

5.1. Purpose: Governance of surveillance process

5.2. People: Capability, capacity and roles of people responsible for surveillance

5.3. Process: How the surveillance process works

6. Credit rating methodologies and their application: What we found

6.1. Purpose: Governance of methodology process and application

6.2. People: Capability, capacity and roles of people involved in methodologies process and application

6.3. Process: How the methodology process and application controls work

7. Internal controls and oversight of the rating committee, surveillance process and methodologies: What we found

7.1. Compliance

7.2. Review

7.3. Risk management

7.4. Internal audit

8. Next steps

9. Annex: ESG factors in credit rating methodologies and surveillance