How Credit Rating Agencies Actually Assess Company Risk
Moody's, S&P Global Ratings, and Fitch assign letter grades to corporate debt, and those grades quietly set the price of money for most large companies on earth. They influence what a company pays to borrow, which funds are allowed to own its bonds, and sometimes whether it can refinance at all. I spent years at American Express, which funds a large lending business in the debt markets, so these grades were part of the furniture, and I was always struck by how few people could describe how one actually gets made.
The odd part is that the methodology is public, readable, and useful well beyond bonds. The agencies have effectively published a complete framework for judging whether a business can survive its own balance sheet, and you can borrow it for free. Here's how it works and what I'd do with it.
Why three letters carry so much weight
The big three didn't win on analytical brilliance alone; regulation baked them in decades ago. In the US, the SEC designates certain firms as Nationally Recognized Statistical Rating Organizations, and years of investment mandates, fund charters, and bank capital rules were written to reference their grades. A pension fund's charter might allow only investment grade paper. An insurer's capital charges can depend on the ratings of the bonds it holds. When the plumbing of the financial system references your opinion, your opinion moves markets whether it's right or not.
The track record is decent in aggregate. The agencies publish default studies going back decades, and they show what you'd hope to see: defaults are rare at the top of the scale and get dramatically more common as you walk down it, so the rank ordering broadly works. The famous failures, with structured finance in 2008 at the top of the list, were failures of timing and incentives more than failures of the underlying framework. Both facts belong in your head at once, and the practical translation is to trust the ordering more than the timing.
Reading the scale
S&P and Fitch run from AAA at the top through AA, A, and BBB, then across the line into BB, B, CCC, and eventually D for default, with plus and minus signs splitting most categories into finer notches. Moody's uses its own notation, Aaa, then Aa1 through Aa3, A1 through A3, Baa1 through Baa3, and so on, with numbers doing the work of the signs. The scales map onto each other closely enough that practitioners treat them as interchangeable.
The line that matters most sits between BBB- and BB+, or Baa3 and Ba1 in Moody's terms. Everything at BBB- and above is investment grade. Everything below is high yield, or junk if you're being honest. A lot of institutional money is contractually barred from holding anything under that line, so a downgrade across it, the fallen angel scenario, triggers waves of selling that have nothing to do with anyone's view of the company that week. If you own the equity, a slide toward that boundary deserves attention long before the downgrade lands, because management will start making decisions (asset sales, dividend cuts, surprise equity raises) specifically to defend the rating.
Each notch gets priced, too. Investors demand more yield from a BBB- issuer than from a BBB+ one, all else equal, and the gap widens sharply once you cross into high yield. For a company carrying serious debt, one notch can be worth real money in annual interest expense, which is why CFOs will bend strategy around it.
The two questions every methodology asks
Strip away the branding and each agency's corporate methodology reduces to two questions. How risky is the business, and how risky is the balance sheet sitting on top of it?
Business risk covers competitive position, industry dynamics, and the operating environment. Analysts look at market share and whether anything durable defends it, customer concentration, how cyclical the industry runs, and how vicious the competition is. A regulated utility with predictable returns scores very differently from a mid-tier apparel retailer before anyone opens a balance sheet.
Financial risk is the quantitative half: leverage, coverage, and cash generation, measured against thresholds the agencies publish for each rating level. The workhorse metrics are debt to EBITDA, funds from operations to debt, interest coverage, and free cash flow relative to debt. The maturity profile matters as much as the totals, since a company with moderate leverage and a wall of debt due next year can be a worse credit than a heavily levered one with nothing maturing for a decade. The debt footnote in the 10-K lays those maturities out year by year, and it takes two minutes to check.
The two halves trade off against each other explicitly, and that's the part worth internalizing. A company with a fortress business can carry more leverage at any given rating than a company in a volatile industry. S&P's corporate criteria literally cross a business risk profile with a financial risk profile in a matrix to produce an anchor rating, then adjust for things like liquidity, financial policy, and peer comparisons. That document is free to read, and it makes a better analytical checklist than most equity research templates I've seen.
A quick worked example
Say a company reports 2 billion dollars of debt, 800 million of EBITDA, and 120 million of annual interest expense. Debt to EBITDA comes out at 2.5x and interest coverage lands around 6.7x, numbers that would sit comfortably in investment grade territory for a stable business. Now put those exact numbers on a commodity producer at the top of its price cycle. The agency will rerun them on mid-cycle price assumptions, and if normalized EBITDA comes back closer to 400 million, leverage is suddenly 5x and coverage is roughly halved. The rating gets set on the normalized numbers, and that habit, stressing the inputs before trusting the ratio, is worth stealing for any analysis you do.
The judgment layer on top
Ratios anchor the rating, and then a set of qualitative calls moves it. Management gets assessed on its track record against its own stated plans, on the quality and consistency of its reporting, and above all on its financial policy. A team that has said publicly, over and over, that it will defend its rating is a different credit from one that funds buybacks with debt whenever the stock dips, even when today's ratios look identical.
Governance problems push ratings down: related party transactions, aggressive accounting, boards that can't say no. Jurisdiction matters as well: a company domiciled where courts are slow or politics reach into boardrooms will usually rate below an identical business in a stable legal environment, and sovereign ratings often act as a ceiling on the corporates underneath them.
Same framework, different weights by industry
The emphasis shifts with the kind of company being rated. For banks, the analysis centers on capital adequacy, asset quality, funding stability, and liquidity, because leverage is the business model itself. For regulated utilities, the regulatory framework dominates, meaning how reliably the utility recovers its costs and earns its allowed return. For technology companies, agencies think hard about product cycles and whether today's market position survives the next platform shift, which is why tech businesses with pristine current numbers sometimes rate lower than you'd guess. For oil, gas, and mining, everything runs through mid-cycle price decks rather than spot prices, so ratings don't whipsaw with every rally.
If you analyze companies across sectors, this is a discipline worth copying. The right question set for a bank is nearly useless for a software company, and the agencies have already written sector-specific question sets and posted them on their websites.
How a rating actually gets made
The process is more committee-driven than most people assume. A lead analyst and a small team pull apart the filings, meet management, and build projections, usually with access to internal detail and forecasts that public investors never see. The lead analyst then takes a recommendation to a rating committee of senior people who weren't involved in the work, and the committee debates and votes. The issuer gets to review the draft for factual accuracy and confidential information before publication, but it doesn't get a vote on the outcome. After that, the rating sits under continuous surveillance and gets revisited as results come in.
Two signals ride alongside the letter grade and are worth watching. Outlooks (positive, stable, negative) tell you which way the agency leans over the next year or two. Watch listings flag a possible change in the near term, usually tied to a specific event like a merger, a lawsuit, or a covenant problem. A BBB credit on stable outlook and a BBB credit on negative watch are very different animals, and any screen that only captures the letter grade misses it.
What ratings won't tell you
Ratings are opinions about relative default risk over a long horizon, and the agencies themselves warn against reading them as market timing signals. By the time weak results show up in filings, get digested by an analyst, and clear a committee, the bond market has usually repriced. Prices tend to move well before the downgrade arrives, so treat the rating as a map of the terrain rather than a weather report.
Ratings also handle sudden events badly. Fraud, litigation, regulatory action, and leveraged buyouts can take a credit from solid to distressed faster than any surveillance cycle can react, which is how Enron and Lehman stayed investment grade almost to the end. And the business model carries a known conflict, since issuers pay for their own ratings. That conflict sat at the center of the structured finance blowup in 2008, and the Dodd-Frank reforms of 2010 put the agencies under closer SEC oversight because of it. Corporate ratings came through that period in far better shape than structured products did, but the sensible posture is to treat a rating as a paid opinion with a long track record, then verify the parts that matter to your decision.
How I'd actually use them
A few habits, in rough order of value.
- Read the full rating report. Rating action press releases are public on the agency websites, and they're dense with useful material: the ratios the agency is watching, the explicit triggers that would move the rating in either direction, and a compressed bull and bear case for the credit. When an agency writes that it could lower a rating if leverage stays above a stated threshold, it has handed you a monitoring checklist.
- Treat rating actions as events. When a bond falls out of investment grade, index funds and mandate-constrained holders sell because they have to, and that selling can overshoot anything the fundamentals justify. Some credit investors build whole strategies around fallen angels for exactly this reason. A downgrade of a company you already follow is a good moment to look harder, on both the debt and the equity side.
- Steal the framework for equity work. The business and financial risk split, the published ratio thresholds, mid-cycle normalization, and the financial policy assessment all transfer directly to stock analysis. Balance sheet strength decides which companies get to play offense in a recession, and the agencies have already scored it for you.
- Disagree deliberately. Take the agency view as your baseline and spend your time where your read differs. If you think an agency is underrating a company's pricing power, or leaning on a moat that's quietly eroding, that disagreement is exactly where your work should concentrate.
None of this needs expensive tools. EDGAR has the filings, the agencies publish methodologies and rating actions free with registration, and the proxy statement will tell you whether executive pay rewards the same leverage the rating committee worries about. The letter grade is only the headline, and the reasoning underneath it sits in public view for anyone willing to read it.