Credit risk appetite is expressed both in terms of credit risk economic equity and in terms of the impact of credit risk on earnings volatility.

Credit risk appetite is set by the board and is described and reported through a suite of metrics derived from a combination of accounting and credit portfolio model parameters which in turn use the various credit risk rating systems as inputs. These metrics are supplemented by a variety of policies, sector caps and limits to manage concentration risk at an acceptable level.

The principal sources of credit risk within the Group arise from loans and advances to retail customers, financial institutions and corporate clients. The credit risk exposures of the Group are set out in note 49 to the financial statements.

In terms of loans and advances, credit risk arises both from amounts lent and commitments to extend credit to a customer as required. These commitments can take the form of loans and overdrafts, or credit instruments such as guarantees and standby, documentary and commercial letters of credit. With respect to commitments to extend credit, the Group is potentially exposed to loss in an amount equal to the total unused commitments. However, the likely amount of loss is less than the total unused commitments, as most retail commitments to extend credit can be cancelled and the credit worthiness of customers is monitored frequently. In addition, most wholesale commitments to extend credit are contingent upon customers maintaining specific credit standards, which are regularly monitored.

Credit risk can also arise from debt securities, derivatives and foreign exchange activities. Note 17 to the financial statements shows the total notional principal amount of interest rate, exchange rate, credit derivative and equity and other contracts outstanding at 31 December 2008. The notional principal amount does not, however, represent the Group's credit risk exposure, which is limited to the current cost of replacing contracts with a positive value to the Group. Such amounts are reflected in note 49.

Credit risk exposures in the insurance businesses arise primarily from holding investments and from exposure to reinsurers.

In measuring the credit risk of loans and advances to customers and to banks at a counterparty level, the Group reflects three components: (i) the 'probability of default' by the client or counterparty on its contractual obligations; (ii) current exposures to the counterparty and their likely future development, from which the Group derives the 'exposure at default'; and (iii) the likely loss ratio on the defaulted obligations (the 'loss given default').

The Group assesses the probability of default of individual counterparties using internal rating models tailored to the various categories of counterparty. For its retail lending, and a growing number of wholesale lending portfolios, exposure at default and loss given default models are also in use. All material rating models are authorised by executive management. They have been developed internally and use statistical analysis, combined, where appropriate, with external data and subject matter expert judgement. Each rating model is subject to a rigorous validation process, undertaken by independent risk teams, which includes benchmarking to externally available data, where possible.

Each probability of default rating model segments counterparties into a number of rating grades, each representing a defined range of default probabilities. Exposures migrate between classifications if the assessment of the obligor probability of default changes. Each rating system is required to map to a master scale, which supports the consolidation of credit risk information across portfolios through the adoption of a common rating scale. Given the differing risk profiles and credit rating considerations, the underlying risk reporting has been split into two distinct master scales, a retail master scale and a wholesale master scale. (Note 49 to the financial statements provides an analysis of the portfolio.)

The rating systems described above assess probability of default, exposure at default and loss given default, in order to derive an expected loss. In contrast, impairment allowances are recognised for financial reporting purposes only for losses that have been incurred at the balance sheet date based on objective evidence of impairment (see note 20 to the consolidated financial statements). Due to the different methodologies applied, the amount of incurred credit losses provided for in the financial statements differs from the amount determined from the expected loss model that is used for internal operational management and banking regulation purposes.

The Group's debt securities holdings, which are the subject of external agency ratings, are marked to market and independently checked by the middle office function within the products and markets business. Similarly, debt security investments within Scottish Widows are independently marked to market.

The Group also employs a statistically-based credit portfolio model, which models portfolio credit risk based on defaults and calculates the economic equity employed and credit value at risk for each portfolio.

The Group uses a range of approaches to mitigate credit risk.

Internal control

• Credit principles and policy: group risk sets out the Group credit principles and policy according to which credit risk is managed, which in turn is the basis for divisional and business unit credit policy. Principles and policy are reviewed regularly and any changes are subject to a review and approval process. Divisional and business unit policy includes lending guidelines, which define the responsibilities of lending officers and provide a disciplined and focused benchmark for credit decisions. Credit policy also specifies maximum holding period limits for the credit trading portfolios.
• Counterparty limits: Limits are set against all types of exposure in a counterparty name, in accordance with an agreed methodology for each exposure type. This includes credit risk exposure on individual derivative transactions, which incorporates potential future exposures from market movements. Aggregate facility levels by counterparty are considered and limit breaches are subject to escalation procedures.
• Individual credit assessment and sanction: Credit risk in wholesale portfolios is subject to individual credit assessments, which consider the strengths and weaknesses of individual transactions and the balance of risk and reward. Exposure to individual counterparties, groups of counterparties or customer risk segments is controlled through a tiered hierarchy of delegated sanctioning authorities. Approval requirements for each decision are based on the transaction amount, the customer's aggregate facilities, credit risk ratings and the nature and term of the risk. The Group's credit risk appetite criteria for counterparty underwriting are the same as that for assets intended to be held over the period to maturity.
• Credit scoring: In its principal retail portfolios, the Group uses statistically-based decisioning techniques (primarily credit scoring). Divisional risk departments review scorecard effectiveness and approve changes, with material changes to scorecards that form part of a probability of default rating system subject to group risk approval.
• Controls over rating systems: The Group has established a robust and independent process built on a set of common minimum standards designed to challenge the discriminatory power of the systems, accuracy of calibration and ability to rate consistently over time and across obligors. The internal rating systems are developed and implemented by independent risk functions either in the business units or divisions with the business unit managing directors having ownership of the systems. They also take responsibility for ensuring the validation of the respective internal rating systems, supported and challenged by specialist functions in their respective division.
• Cross-border and cross-currency exposures: Country limits are authorised by Country Limits Panel and managed by a dedicated unit taking into account economic and political factors.
• Concentration risk: Credit risk management includes portfolio controls on certain industries, sectors and product lines to reflect risk appetite. Credit policy is aligned to the Group's risk appetite and restricts exposure to certain high risk and more vulnerable sectors. Note 19 to the accounts provides an analysis of loans and advances to customers by industry (for wholesale) and product (for retail). Exposures are monitored to prevent excessive concentration of risk. These concentration risk controls are not necessarily in the form of a maximum limit on lending but may instead require new business in concentrated sectors to fulfil additional hurdle requirements. The Group's large exposures are reported in accordance with regulatory reporting requirements.
• Stress testing and scenario analysis: The credit portfolio is also subjected to stress-testing and scenario analysis, to simulate outcomes and calculate their associated impact. Events are modelled at a group wide level, at divisional and business unit level and by rating model and portfolio, for example, for a specific industry sector.
• Specialist expertise: Credit quality is maintained by specialist units providing, for example: intensive management and control; security perfection, maintenance and retention; expertise in documentation for lending and associated products; sector-specific expertise; and legal services applicable to the particular market place and product range offered by the business.
• Daily settlement limits: Settlement risk arises in any situation where a payment in cash, securities or equities is made in the expectation of a corresponding receipt in cash, securities or equities. Daily settlement limits are established for each counterparty to cover the aggregate of all settlement risk arising from the Group's market transactions on any single day.
• Risk assurance and oversight: Divisional and group level oversight teams monitor credit performance trends, review and challenge exceptions to planned outcomes and test the adequacy of credit risk infrastructure and governance processes throughout the Group. This includes tracking portfolio performance against an agreed set of key risk indicators. Risk assurance teams are engaged where appropriate to conduct further credit reviews if a need for closer scrutiny is identified.

Collateral

The principal collateral types for loans and advances are:

• mortgages over residential properties;
• charges over business assets such as premises, inventory and accounts receivable;
• charges over financial instruments such as debt securities and equities; and
• guarantees received from third parties.

The Group maintains guidelines on the acceptability of specific classes of collateral.

Collateral held as security for financial assets other than loans and advances is determined by the nature of the instrument. Debt securities, treasury and other eligible bills are generally unsecured, with the exception of asset-backed securities and similar instruments, which are secured by portfolios of financial assets. Collateral is generally not held against loans and advances to financial institutions, except where securities are held as part of reverse repurchase or securities borrowing transactions or where a collateral agreement has been entered into under a master netting agreement. Collateral or other security is also not usually obtained for credit risk exposures on derivative instruments, except where the Group requires margin deposits from counterparties.

It is the Group's policy that collateral should always be realistically valued by an appropriately qualified source, independent of the customer, at the time of borrowing. Collateral is reviewed on a regular basis in accordance with business unit credit policy, which will vary according to the type of lending and collateral involved. In order to minimise the credit loss, the Group may seek additional collateral from the counterparty as soon as impairment indicators are identified for the relevant individual loans and advances.

The Group considers risk concentrations by collateral providers and collateral type, as appropriate, with a view to ensuring that any potential undue concentrations of risk are identified and suitably managed by changes to strategy, policy and/or business plans.

Master netting agreements

Where it is efficient and likely to be effective (generally with counterparties with which it undertakes a significant volume of transactions), the Group enters into master netting agreements. Although master netting agreements do not generally result in an offset of balance sheet assets and liabilities, as transactions are usually settled on a gross basis, they do reduce the credit risk to the extent that, if an event of default occurs, all amounts with the counterparty are terminated and settled on a net basis. The Group's overall exposure to credit risk on derivative instruments subject to master netting agreements can change substantially within a short period since it is affected by each transaction subject to the agreement.

Other credit risk transfers

The Group also undertakes asset sales, securitisations and credit derivative-based transactions as a means of mitigating or reducing credit risk, taking into account the nature of assets and the prevailing market conditions.

• Portfolio monitoring and reporting: In conjunction with group risk, businesses and divisions identify and define portfolios of credit and related risk exposures and the key benchmarks, behaviours and characteristics by which those portfolios are managed in terms of credit risk exposure. This entails the production and analysis of regular portfolio monitoring reports for review by senior management. Group risk in turn produces an aggregated review of credit risk throughout the Group, including reports on significant credit exposures, which are presented to the group business risk committee.
• The performance of all rating models is comprehensively monitored on a regular basis, to ensure that models continue to provide optimum risk differentiation capability, the generated ratings remain as accurate and robust as possible and the models assign appropriate risk estimates to grades/pools. All models are monitored against a series of agreed key performance indicators. In the event that monthly monitoring identifies material exceptions or deviations from expected outcomes, these will be escalated.