Internal Rating Based Approach for Credit Risk: FIRB and AIRB (CAIIB RM)

Every CAIIB Risk Management candidate meets the internal rating based approach sooner or later, usually right after Standardised Approach risk weights start feeling too blunt for exam questions. The internal rating based approach is the Basel credit-risk framework that lets a bank use its own default and loss estimates, instead of regulator-fixed risk weights, to compute capital. It comes in two flavours — Foundation IRB and Advanced IRB — and both hinge on four inputs: PD, LGD, EAD, and maturity. This article walks through FIRB versus AIRB, the risk-weight function behind them, the supervisory validation banks must clear, and exactly where India stands on adoption as of July 2026.

📊 What Is the Internal Ratings-Based Approach?

Basel II gave banks three ways to hold capital against credit risk: the Standardised Approach (external ratings and fixed risk weights), Foundation IRB, and Advanced IRB. Under both IRB variants, a bank builds its own rating system — grading borrowers into pools based on probability of default — rather than relying purely on external agency ratings. The logic is that a bank's own default history, scored through validated statistical models, prices risk more accurately than a one-size-fits-all regulatory table.

The IRB approach sits inside the broader risk management framework that CAIIB candidates study before touching capital adequacy numbers — you cannot understand why IRB matters without first understanding what problem Basel capital rules are solving in the first place. IRB was never optional plug-and-play; a bank must earn supervisory approval, asset class by asset class, before switching any portfolio away from the Standardised Approach.

Under IRB, exposures are split into asset classes — corporate, sovereign, bank, retail, and equity — each with its own risk-weight formula. Retail exposures are a special case: only Advanced IRB is permitted there, because the foundation variant's supervisory LGD and EAD floors were designed around wholesale, not retail, loss patterns. For every other asset class, a bank chooses between Foundation and Advanced, and that choice is exactly where FIRB and AIRB diverge.

🔬 FIRB vs AIRB: Where the Estimates Come From

The single cleanest way to remember the difference: under Foundation IRB, the bank estimates only Probability of Default (PD) from its own data; Loss Given Default (LGD), Exposure at Default (EAD), and effective maturity are all supervisory-prescribed. Under Advanced IRB, the bank estimates all four — PD, LGD, EAD, and maturity — subject to regulatory floors and rigorous validation.

That single design choice cascades into everything else. A bank running FIRB for its corporate book plugs its internal PD into the risk-weight formula but must use the regulator's standard LGD assumption — historically around 45% for senior unsecured claims and 75% for subordinated claims — and a supervisory EAD conversion factor. A bank cleared for AIRB instead feeds its own loss-history-based LGD and EAD models into the same formula, which usually produces sharper, more risk-sensitive capital numbers, but only if the underlying data and models survive supervisory scrutiny.

Post-crisis Basel III reforms tightened this further for large, low-default portfolios. Exposures to banks, other financial institutions, and large corporates above a defined revenue threshold were pushed out of AIRB entirely and restricted to FIRB or the Standardised Approach — regulators had seen too much model risk in loss estimates for portfolios with too few actual defaults to validate against. AIRB survives mainly for retail and mid-sized corporate exposures, where banks genuinely have enough default data to support it.

💡 Exam Tip: If a question asks "which parameter is common to FIRB and AIRB," the answer is always PD — it is the only input the bank estimates under both variants.

🧮 PD, LGD, EAD and the Risk-Weight Function

The Basel IRB risk-weight formula is built on the Asymptotic Single Risk Factor (ASRF) model — essentially a Vasicek-style credit portfolio model calibrated to a 99.9% confidence level over a one-year horizon. Feed in PD and LGD, apply an asset-correlation factor that itself varies with PD (lower for higher-PD borrowers, on the logic that riskier borrowers are more idiosyncratic and less systemically correlated), apply a maturity adjustment that penalises longer-tenor exposures, and multiply by EAD to get the capital requirement in rupee or dollar terms.

EAD deserves special attention for derivative and off-balance-sheet exposures, because it is not simply the drawn amount. For counterparty exposures arising from swaps, options, and forwards, EAD calculation methodology overlaps directly with the netting and add-on concepts covered under derivatives and risk management — a candidate who has not revised how a forward contract or an options position generates counterparty credit exposure will struggle to apply the IRB EAD concept correctly in a case-study question.

Maturity (M) matters because a five-year corporate loan carries more migration risk than a six-month one, even at identical PD and LGD — the formula's maturity adjustment scales the risk weight upward as tenor lengthens. Under AIRB, banks calculate their own effective maturity for each facility, subject to a one-year floor and a five-year cap for most exposure types; under FIRB, a flat 2.5-year assumption is applied instead, which is simpler but less risk-sensitive.

None of this is exam trivia only — the same PD/LGD/EAD building blocks reappear when candidates study expected loss provisioning and portfolio-level capital planning, which is why IRB questions routinely cross-reference asset-liability and balance-sheet risk concepts covered elsewhere in the Risk Management elective.

🇮🇳 India's Position: Standardised Approach Only

As of July 2026, the Reserve Bank of India has not permitted domestic scheduled commercial banks to use either Foundation IRB or Advanced IRB for regulatory capital computation. RBI's Basel III capital regulations framework, issued under its master circular/master direction on capital adequacy, mandates the Standardised Approach for credit risk across the Indian banking system. This has been RBI's consistent stance since the Basel II implementation roadmap in the mid-2000s, when the IRB migration path for Indian banks was left open in principle but never activated in practice, citing concerns around data history depth, model validation capacity, and a level playing field across public, private, and foreign banks operating in India.

That does not mean IRB concepts are irrelevant to Indian banks. Many large banks run internal rating models for credit approval, pricing, and portfolio monitoring — but these internal grades feed business decisions and provisioning judgment, not the regulatory capital number, which still runs through Standardised Approach risk weights published by RBI. A CAIIB candidate should be precise on this distinction: internal ratings for decisioning are common in India; internal ratings for regulatory capital under IRB are not permitted anywhere in the country yet. Read RBI's published capital regulations directly at rbi.org.in rather than assuming India has quietly moved to IRB.

Wherever IRB is permitted internationally, supervisors demand a "use test" — the rating system must genuinely drive credit decisions, not exist solely for capital arbitrage — plus a minimum multi-year track record (commonly five years of PD data, seven for LGD and EAD under AIRB), independent model validation, and ongoing backtesting against realised defaults. A bank that clears IRB approval must still run its own ICAAP process in banks alongside Pillar 1 IRB capital, because IRB output is a floor, not a substitute for a bank's own internal capital assessment. IRB banks internationally also carry heavier Pillar 3 disclosure requirements, publishing PD, LGD, and EAD ranges by asset class — disclosure that Standardised Approach banks in India are not required to match in the same granularity.

⚠️ Common Mistake: Do not write in an exam answer that "Indian banks use IRB for retail loans" — no Indian bank currently computes regulatory capital under IRB for any asset class; all use the Standardised Approach.

🎯 Exam Takeaways and Practice

For CAIIB Risk Management, lock in three facts: PD is common to FIRB and AIRB, LGD and EAD separate the two variants, and India runs Standardised Approach only. Capital regulation of this kind also sits upstream of broader macro-financial questions — tighter or looser bank capital constraints influence how quickly policy rate changes pass through to lending rates, a theme explored in monetary policy transmission mechanism in India if you want the macro side of the same capital-and-credit story.

Compare this framework against the analogous choice on the operational-risk side, where India similarly applies only the standardised approach for operational risk capital rather than any advanced measurement alternative — the same "keep it simple, keep it comparable across banks" philosophy runs through both.

📌 Remember: Internal rating based approach = Basel credit-risk framework with FIRB (bank estimates PD only) and AIRB (bank estimates PD, LGD, EAD, maturity) — India uses neither for regulatory capital, only the Standardised Approach.

Browse more Risk Management elective coverage on the risk management elective tag hub, and revise the underlying framework once more before attempting the practice questions below.

🧠 Practice MCQs: Internal Rating Based Approach

Want chapter-wise mock tests with 100+ MCQs? Start practising free →

❓ Frequently Asked Questions