CREDIT RISK 101: What PD Actually Measures

Over the weekend, I was talking to a micro lender in Primrose Hill. They'd built their entire pricing model around credit scores: tiered the loan book by score bands, priced accordingly, reported portfolio risk to the board on that basis. Not a proxy. The actual number, standing in for probability of default.

It doesn't. A credit score is a rank-ordering tool. It tells you who is riskier relative to other borrowers in the same pool at the same moment. It does not tell you the probability that a specific borrower will default over a defined horizon. Those are different questions, and treating them as interchangeable breaks pricing from the ground up.

The lender had built an entire rate card on a ranking system, then wondered why their loss rates diverged from forecast as macroeconomic conditions shifted. Credit scores move slowly. Default rates move fast. When you price one as if it were the other, you are flying blind with confidence.

I see this constantly. Not just at early-stage fintechs, but at mid-sized lenders who should know better, and occasionally at institutions that do know better but let operational shortcuts harden into policy. The pressure is always the same: speed to market, simplicity for the business stakeholders, the appeal of a single number that everyone already understands. But simplicity in the input does not create simplicity in the outcome. It creates hidden complexity that surfaces later, in loss rates that no one forecast and portfolio behaviour that no one modelled.

This is what Probability of Default actually measures, how it differs from the proxies that often replace it, and why that distinction determines whether your credit pricing holds under stress.

A shorter version of this post is on LinkedIn.

What PD Is (and What It Is Not)

Probability of Default is the estimated likelihood that a borrower will fail to meet a contractual obligation over a specified time horizon, typically twelve months. It is expressed as a percentage: a PD of 2.5% means that, given current information, there is a 2.5% chance this borrower defaults within the next year.

That definition sounds clean. The problems start when you try to produce it.

PD is not a credit score. A credit score is an ordinal ranking. It tells you that Borrower A is less risky than Borrower B, but it does not tell you how much less risky, and it does not tell you the absolute probability that either will default. A score of 720 does not mean "2% default risk." It means "better than most borrowers scored under this model at this point in time." The score itself is not calibrated to a probability. It is calibrated to relative position.

PD is not a loss rate. Loss rate is what happened historically to a cohort of borrowers. PD is what you expect to happen to a borrower going forward, given current conditions. Historical loss rates inform PD models, but they are backward-looking. PD is forward-looking, and it must adjust for changes in the economic environment, the borrower's circumstances, and the composition of your portfolio. If you price today's loans using last year's loss rates without adjustment, you are assuming the future looks like the past. It rarely does.

PD is not a static attribute. It is a point-in-time estimate that changes as conditions change. A borrower with a 3% PD in a stable economy might have a 6% PD in a recession, even if their credit score has not moved. PD models that do not incorporate forward-looking adjustments, either through macroeconomic overlays or scenario conditioning, are not measuring risk. They are measuring history and hoping it repeats.

The lender in Primrose Hill had conflated all three. They took a credit score, treated it as a probability, and priced it as if it were stable. Then they were surprised when defaults climbed as rates stayed elevated and consumer stress built. The score hadn't warned them because the score wasn't designed to. It was doing exactly what it was built to do: rank borrowers. The failure was in the interpretation.

The Components of a PD Model

A defensible PD model has three layers: the borrower-specific inputs, the time horizon, and the economic adjustment.

Borrower-specific inputs. These are the observable characteristics that drive individual risk: payment history, leverage, liquidity, income stability, sector exposure for commercial borrowers. For consumer credit, this often includes credit bureau data, but it also includes behavioural data if you have it — transaction patterns, account usage, deposit volatility. For corporate credit, it includes financial statements, cash flow ratios, debt service coverage, and market signals if the borrower is publicly traded.

The model takes these inputs and maps them to a probability. This is typically done through logistic regression, survival analysis, or machine learning trained on historical default data. The output is a score, but unlike a credit bureau score, this score is calibrated to a probability scale. A model output of 0.025 means 2.5% probability of default, not "better than 75% of other borrowers."

Calibration is the step most models skip or do poorly. A model can rank-order risk perfectly and still be useless for pricing if it is not calibrated to actual probabilities. Calibration requires comparing the model's predicted probabilities to observed default rates across the distribution, then adjusting so that borrowers predicted to have a 5% PD actually default at close to 5%. This is not a one-time exercise. It is an ongoing validation requirement, because model performance drifts as the portfolio and the economy change.

Time horizon. PD is always defined over a specific period. The standard is twelve months, but the choice depends on the use case. For pricing a one-year term loan, twelve-month PD is appropriate. For pricing a five-year bond, you need either a term structure of PDs or a cumulative PD over the full term.

The math here is not complicated, but it is often done wrong. If the one-year PD is 2%, the two-year cumulative PD is not 4%:

The difference is small at low probabilities, but it compounds quickly at higher risk levels, and it matters for pricing. Most lenders price on one-year PD and assume risk is constant across the term — fine for short-dated credit, but it breaks down for anything longer.

Economic adjustment. This is the layer that separates a PD model from a credit score. A credit score reflects the borrower's current position relative to their history. A PD model reflects it relative to the future. Economic adjustments can be built into the model directly (unemployment rate, GDP growth, interest rate levels) or applied as overlays after a baseline estimate. Either way, the adjustment is necessary because default risk is a function of the environment, not just the borrower.

During the pandemic, many lenders applied manual overlays because the historical training data included nothing like the March 2020 shock. The overlays were imperfect but necessary. A model that cannot adjust to new information is not a risk model. It is a historical summary.

The lender in Primrose Hill had no economic adjustment. Their model was trained on a stretch that ended before the current rate cycle. When I asked how they accounted for rising consumer debt-service ratios, the answer was that they were waiting for enough new default data to retrain. That is not forward-looking risk management. That is waiting for losses to happen so you can describe them.

The Formula (and What It Hides)

The simplest expression of PD in a logistic regression framework is:

where z is a linear combination of input variables:

Each X is a borrower characteristic (debt-to-income ratio, payment history score, etc.), each β is a coefficient representing that characteristic's weight, and β₀ is the baseline log-odds of default when all other variables are zero.

This formula is clean, interpretable, and widely used. It is also where most of the assumptions hide.

The linearity assumption in z means the model assumes each input relates to the log-odds of default linearly. That is often false. Leverage's effect on default risk accelerates at high leverage. Income volatility has thresholds where small changes produce large risk changes. Ignore these non-linearities and the model underestimates risk in the tails.

The independence assumption means the model assumes the inputs are not correlated in ways that amplify risk. Also often false. In a recession, unemployment rises, income falls, and asset values drop simultaneously. A borrower who loses their job is also more likely to face falling home equity and rising debt service. Treat these as independent and you underestimate the probability of joint stress.

Machine-learning models can relax some of these assumptions but introduce their own problems — a gradient-boosted tree captures non-linearities without manual specification, but it is harder to interpret, explain to regulators, and validate:

# A GBM can fit interactions automatically — but you still owe a calibration step.
from sklearn.ensemble import GradientBoostingClassifier
from sklearn.calibration import CalibratedClassifierCV

raw = GradientBoostingClassifier().fit(X_train, y_default)
# Raw model ranks well but is NOT a probability until calibrated:
pd_model = CalibratedClassifierCV(raw, method="isotonic", cv="prefit")
pd_model.fit(X_calib, y_calib)
pd = pd_model.predict_proba(X_new)[:, 1] # THIS is a PD; the raw score was not

The trade-off is not obvious. A simpler model you understand and can adjust is often more useful than a complex one you cannot explain when it starts producing counterintuitive outputs.

The formula also does not show the calibration step. After the model produces a raw score, that score must be mapped to an actual probability by comparing predictions to observed outcomes across score bands. If the model predicts 100 borrowers have a 5% PD and only 3 default, it is not calibrated.

Why This Matters for Pricing

Credit pricing is built on three components: the probability of default, the loss given default, and the exposure at default.

where EAD is exposure at default — the amount outstanding when the borrower fails.

If your PD is wrong, your expected loss is wrong, and your pricing is wrong. It does not matter how precise your LGD model is or how tight your funding costs are. If you underestimate PD by 50 basis points, you underprice risk by 50 basis points times your LGD, and that gap shows up in loss rates within a year.

The Primrose Hill lender was underpricing by more than that. Their model did not adjust for the rate environment, so they treated today's borrowers as if they carried the same risk as borrowers from the cheap-money years, when rates were near zero and debt service was easy. The actual PD for a borrower in their mid score band had risen by at least 100 basis points. The pricing had not moved. The result was predictable: loss rates ran well above forecast, and the portfolio was bleeding.

This is not a rare failure. It is the most common failure in credit risk management, and it happens because PD is treated as a static input rather than a dynamic estimate. When the model is not maintained, not recalibrated, not adjusted, it stops being a risk model and becomes a historical artifact. You are pricing today's loans on yesterday's risk — and the market does not care about your forecast. It cares about what actually defaults.

The Edge Cases No One Prices For

The standard PD model assumes each borrower's risk is independent of your other borrowers. This is false at the portfolio level, and it breaks down completely in a crisis.

If you are concentrated in a single geography and it enters a recession, your borrowers' risks are correlated — same labour market, same housing market, same local shock. A model treating each borrower as independent underestimates the probability that many default simultaneously, and so underestimates portfolio-level risk.

The same applies to single-sector concentration — commercial real estate, oil and gas. A shock hits all borrowers at once. Individual PD estimates might be accurate on average, but the portfolio loss will be much higher than the sum of individual expected losses, because defaults cluster.

This is not a flaw in the PD model. It is a limitation of using PD in isolation. Portfolio risk management requires a second layer — a model of how individual risks interact and how losses compound under stress, usually a credit portfolio model sitting on top of the PD estimates. Most lenders do not build one, because it is hard, the data requirements are steep, and it is not required by regulation for most portfolios.

So most lenders price credit as if borrowers' risks are independent even when they know they are not. Fine in normal times. Catastrophic in a downturn, when defaults cluster and the portfolio loss exceeds every forecast.

The Primrose Hill lender had this problem too. Concentrated in consumer unsecured lending, their borrowers were all exposed to the same pressures: rising rates, falling real incomes, tightening credit. When defaults rose, they rose across the portfolio. The individual PD estimates were not wrong, but the portfolio-level forecast was off by a factor of two, because the model had not accounted for correlation.

What a Proper PD Model Requires

Building a defensible PD model is not a weekend project. It requires historical default data spanning multiple economic cycles, so the model learns what default looks like in good times and bad. It requires borrower-level data at origination and over the life of the loan, so it captures how risk evolves. It requires a validation framework to test whether predictions match outcomes, and a recalibration process to adjust as the portfolio and economy change.

It also requires judgment. No model captures every driver of risk, and none predicts the future perfectly. There will always be cases where the output does not match intuition — where a borrower looks riskier or safer than the model suggests — and you have to decide whether to override or trust it. That decision is not statistical. It is a judgment call informed by experience, knowledge of the borrower, and understanding of what the model does and does not capture.

The lenders who manage credit risk well are not the ones with the most sophisticated models. They are the ones who understand what their models measure, where they break down, and when to adjust. They treat PD as an input, not an answer.

The lenders who manage it poorly treat PD as a black box — or worse, treat a credit score as PD and assume the problem is solved. It is not solved. It is deferred, and it surfaces later, in loss rates that no one forecast and capital erosion that no one planned for.

Close

Next week: how LGD and EAD turn a probability into a loss forecast, and why most lenders get the relationship wrong.

If you are pricing credit and you are not confident in the inputs driving your rate card, take five minutes to map where your PD estimates come from and whether they adjust for current conditions: book a meeting with me