Written by: Andrew Cohen, CFA, CPA, Managing Partner, Condesa Financial Group

Key Takeaways From This 7-Step Credit-Risk Framework

• The AR aging report functions as a credit-risk instrument when someone interprets it with structure and judgment instead of only producing data for audits, lenders, and boards.
• The framework has seven steps: bucket percentages (Step 1), trend analysis (Step 2), concentration (Step 3), exceptions (Step 4), expected credit loss (Step 5), key ratios (Step 6), and memo documentation (Step 7).
• Core metrics include the 60/90+ rule, 3–6 month trend analysis, top-5 customer concentration ratios, and GAAP-compliant CECL loss estimation under FASB ASC 326.
• Consistent processes and qualified oversight reduce common pitfalls such as relying on single snapshots, ignoring concentration, and skipping forward-looking adjustments.
• Condesa Financial delivers fractional CFO-level credit-risk oversight and CECL-aligned documentation at a price-competitive, ex-Big 4 nearshore rate for SMEs.

Schedule A Credit-Risk Review

Before You Begin: Core Terms, Setup, And Roles

This article assumes you already know how to prepare an AR aging report. The focus here is exclusively on using that report as a credit-risk instrument, which is a different exercise from collections or routine accounting.

Key terms used throughout this framework:

• Aging buckets: The time-based groupings into which outstanding invoices are sorted, typically current (not yet due), 1–30 days past due, 31–60 days past due, 61–90 days past due, and 90+ days past due.
• Past-due AR: The total dollar balance of invoices beyond their contractual due date.
• Total AR: The gross outstanding receivables balance before any allowance.
• DSO (Days Sales Outstanding): Average AR divided by total credit sales, multiplied by the number of days in the period, which measures how quickly credit sales convert to cash.
• Customer concentration: The degree to which receivables or revenue depend on a small number of customers.
• Expected credit loss (CECL): Under FASB ASC 326, the lifetime expected loss on a financial asset, estimated at origination using historical experience, current conditions, and reasonable and supportable forecasts.
• Allowance for credit losses: The contra-asset account representing the cumulative expected loss on the receivables balance at the reporting date.

To run this framework, you need a reliable AR aging report, at least 3–6 months of historical aging data for trend analysis, access to customer payment histories, and a documented credit policy if one exists.

The controller, credit manager, CFO or fractional CFO, sales leadership, and sometimes legal counsel all play a role. Company size, industry, customer mix, billing cycles, and whether finance is internal or outsourced all shape how the assessment looks in practice.

Steps 1 through 4 usually sit comfortably with a strong controller or credit manager. Steps 5 through 7, which cover expected loss estimation, ratio benchmarking, and memo documentation, benefit from fractional CFO oversight when the allowance must withstand audit or lender scrutiny. Condesa Financial Group provides that fractional CFO-level discipline at a price-competitive, ex-Big 4 nearshore rate that SMEs can sustain.

Talk With A Fractional CFO

Step 1: Calculate Bucket Percentages And Apply The 60/90+ Rule

Purpose: Establish the current risk profile of the receivables portfolio by quantifying how much of total AR sits in each aging bucket.

Formula: Past-due AR in each bucket ÷ Total AR = Bucket percentage.

The 60/90+ rule treats the 61–90 and 90+ day buckets as the primary risk pivot. A healthy AR aging profile holds 80% or more of receivables current or under 30 days past due, with less than 10% in the combined 61–90 and 90+ day buckets. More than 20–25% over 90 days signals collection problems and reduced financing capacity.

To see how the 60/90+ rule works in practice, apply it to a hypothetical $500,000 portfolio:

• Total AR: $500,000
• Current: $350,000 → 70%
• 1–30 days: $75,000 → 15%
• 31–60 days: $40,000 → 8%
• 61–90 days: $20,000 → 4%
• 90+ days: $15,000 → 3%

In this example, 85% of AR is current or under 30 days, and the combined 61–90 and 90+ bucket is 7%. That sits within the healthy threshold. A portfolio where the 90+ bucket alone exceeds 20% requires immediate escalation.

Start with the current period’s AR aging report reconciled to the general ledger. From there, the controller and credit manager need to determine whether the combined 61–90 and 90+ bucket exceeds 10% and whether any single bucket looks disproportionate against historical norms. The output should be a table of bucket percentages for the current period, with each bucket flagged as within or outside the benchmark threshold.

Step 2: Perform Trend Analysis Across 3–6 Months

Purpose: Separate one-time spikes from structural deterioration in credit quality.

A single aging snapshot cannot answer whether the portfolio is getting worse. Tracking bucket percentages across three to six consecutive periods shows whether past-due balances migrate into older buckets, which provides an early signal of deteriorating credit quality. OCC supervisory guidance reinforces evaluating receivables aging trends over time rather than relying on a single aging snapshot.

The table below shows what a deteriorating portfolio looks like across three months, where the current bucket shrinks while every older bucket grows:

This pattern shows a consistent migration of balances from the current bucket into older buckets over three months. That trend warrants a credit-risk escalation even when no single month’s snapshot crosses a hard threshold.

Use aging reports for the prior 3–6 months, each reconciled to the GL. The controller, credit manager, and fractional CFO should confirm whether the current bucket is shrinking while older buckets grow and whether the pattern is consistent or isolated. The deliverable is a completed trend table with a short written conclusion that labels the pattern as a one-time event or a deteriorating trend.

Review Your Aging Trends

Step 3: Quantify Customer Concentration Risk

Purpose: Surface single-customer dependency within the past-due AR portfolio that aggregate bucket percentages hide.

The concentration ratio for this framework is Top-5 customers’ past-due AR ÷ Total past-due AR. This ratio shows whether past-due balances spread across many customers or cluster in a few accounts. The OCC Asset-Based Lending Handbook notes that banks usually treat receivables as concentrated when single accounts represent 10% or more of total receivables. A common benchmark treats top-five customers above 50% of receivables as a signal of dangerous dependence.

Concentration must sit alongside financial-health signals. A 25% exposure to a financially strong customer may be manageable, while the same 25% exposure to a weakening customer is high-risk. For each concentrated account, review payment history, credit terms, and any available external signals such as public financial filings or trade credit reports.

Use customer-level aging detail, payment history by account, and any available credit reports for the top-5 past-due customers. The controller, credit manager, sales leadership, and fractional CFO should agree on whether any single customer represents 10% or more of total AR, whether the top-5 past-due customers exceed 50% of total past-due AR, and whether concentrated accounts show deteriorating payment behavior. The result is a ranked list of top-5 past-due customers with their individual concentration ratios, a combined ratio, and a short note on each account’s financial health signals.

Step 4: Investigate Exceptions

Purpose: Flag accounts within the aging report that require individual assessment instead of pooled treatment.

Exceptions are accounts that bucket percentages alone cannot assess accurately. They include disputed invoices, broken payment promises, customers in bankruptcy or financial distress, chronic late payers, and accounts that have breached their credit limits. Each exception needs investigation before you finalize the expected loss estimate in Step 5.

For each exception, use the following checklist and connect each answer to how you will treat the account in the loss estimate:

• Disputed invoices: Establish the dispute reason and who owns resolution, then set an expected resolution date. The key judgment is whether the dispute reflects a genuine credit problem or an operational error such as an incorrect PO, because each outcome drives a different loss assumption.
• Broken payment promises: Count how many promises this customer has broken in the past 6 months and calculate the promise-to-pay rate. Confirm whether a formal payment plan exists, since that plan often guides the expected recovery pattern.
• Bankruptcies or financial distress: Confirm any bankruptcy filing or restructuring process and estimate the recovery rate. That estimate will usually replace the pooled bucket rate for this customer.
• Chronic late payers: Measure how many consecutive periods this account has appeared in the 61–90 or 90+ bucket and confirm whether a credit limit review has started. Long-running lateness often justifies tighter terms or reduced exposure.
• Credit-limit breaches: Quantify how far the account has exceeded its limit, identify who approved the exception, and confirm whether the limit has been formally revised. These details support both the risk judgment and any policy changes.

Review customer payment history, correspondence logs, credit limit records, and any legal or collections notices. The credit manager, controller, sales leadership, and legal counsel should agree which exceptions represent genuine credit losses versus operational delays and which accounts require individual loss estimation rather than pooled rates. The output is a documented exception log with one row per account, including the exception type, findings, and recommended treatment in the expected loss calculation.

Get Help With Exception Reviews

Step 5: Estimate Expected Credit Loss From Aging Buckets

Purpose: Produce a GAAP-compliant allowance for credit losses using a documented, defensible methodology aligned with FASB ASC 326 (CECL).

Under FASB ASC 326, the aging-schedule method, which applies historical loss rates to each bucket, is the most common CECL-compliant approach for trade receivables. The formula is Bucket balance × Adjusted loss rate = Expected loss for that bucket. Sum across all buckets to determine the required ending allowance.

FASB’s illustrative implementation example in ASC 326-20-55 provides loss rates by aging bucket. Current (not past due) carries 0.3%, and the rate rises with age: 8.0% at 1–30 days, 26.0% at 31–60 days, 58.0% at 61–90 days, and 82.0% beyond 90 days. These rates are illustrative only and cannot be copied into a company’s model. Every entity must derive its own rates from its own historical write-off experience, adjusted for current conditions and reasonable and supportable forecasts.

Worked example using the illustrative rates and the hypothetical portfolio from Step 1:

Required allowance (illustrative): $41,350. The income statement provision equals the change in the allowance balance from the prior period.

A blanket zero-loss assumption on current receivables is not allowed under CECL unless genuinely supportable. The forward-looking adjustment is a required step, and auditors now challenge models that skip it even when historical rates look robust. OCC Bulletin 2026-33 confirms that CECL adoption has passed for all banks, making ASC 326 the operative framework for all OCC-supervised institutions.

Use at least 3–5 years of historical write-off data by aging bucket, current economic conditions relevant to the customer base, and the exception log from Step 4. The controller, fractional CFO, and external auditor should confirm that historical loss rates come from company data, that rates reflect current conditions and forward-looking factors, and that exception accounts receive individual treatment. The final output is a completed expected loss table with documented rate derivation, a forward-looking adjustment note, and a required allowance balance.

Step 6: Calculate Key Ratios

Purpose: Turn the aging analysis into clear signals that lenders, auditors, and leadership can benchmark and discuss.

Four ratios complete the credit-risk picture:

• DSO: (Average AR ÷ Total credit sales) × Number of days in period. A DSO exceeding stated payment terms by more than 15 days indicates a systematic collections problem. DSO under 45 days signals strong AR quality, while DSO over 90 days suggests the business may struggle to qualify for traditional financing.
• 90-day AR / Total AR: Past-due AR in the 90+ bucket ÷ Total AR. Less than 10% is a strong signal, and the 20–25% threshold from Step 1 is the point at which financing constraints typically appear.
• Bad-debt write-offs / Credit sales: Annual write-offs ÷ Annual credit sales. Companies typically write off approximately 4% of AR as bad debt annually. A materially higher rate warrants a review of credit policy and customer underwriting.
• Allowance / AR: Ending allowance for credit losses ÷ Gross AR. This ratio measures reserve adequacy, and a declining ratio in a deteriorating aging environment signals under-provisioning.

Use the income statement for credit sales and write-offs, the balance sheet for AR and the allowance, and prior period ratios for comparison. The controller, fractional CFO, and any commercial lender reviewing financing should confirm whether DSO exceeds terms by more than 15 days, whether the 90+ ratio sits above 10%, and whether the allowance ratio is falling while aging weakens. The deliverable is a four-ratio summary table with current values, prior period comparisons, and a benchmark flag for each ratio.

Benchmark Your AR Ratios

Step 7: Document A Credit-Risk Memo

Purpose: Turn the analysis into a signed, auditable deliverable that makes the credit-risk conclusion defensible to auditors, lenders, and the board.

Documentation is the differentiating deliverable. An undocumented analysis will not survive audit or lender review, no matter how well executed. SEC registrants face particular CECL scrutiny under SAB 119, which calls for a consistent and systematic estimation process with clear documentation of judgments. The memo structure below satisfies that requirement and provides a copy-ready template for SME use.

Credit-Risk Memo Template:

• Assessment Date: [Date memo is finalized]
• Period Covered: [Month/quarter and year of the aging report]
• Bucket Analysis Summary: [Current period bucket percentages; flag any bucket exceeding threshold]
• Trend Findings: [3–6 month trend table; conclusion on whether deterioration is structural or isolated]
• Concentration Findings: [Top-5 past-due customer concentration ratio; individual account notes]
• Exception Summary: [List of exception accounts; investigation findings; treatment in loss estimate]
• Expected Loss Estimate: [Completed expected loss table; required allowance balance; prior period comparison]
• Key Ratios: [DSO, 90+ ratio, write-off rate, allowance/AR; benchmark flags]
• Recommended Actions: [Credit limit adjustments, collections escalations, policy changes]
• Escalation Triggers: [Conditions that require immediate CFO or board notification, such as any customer entering bankruptcy or the 90+ bucket exceeding 20%]
• Prepared by / Reviewed by / Date: [Names and sign-off dates]

Use all outputs from Steps 1–6. The controller, fractional CFO, external auditor, and board or audit committee should confirm that every conclusion traces back to a data source, that escalation triggers are defined and measurable, and that a qualified second party has reviewed the memo. The final deliverable is a signed memo filed in the period-end close package, with supporting workpapers attached.

Common Mistakes, Watch Outs, And Troubleshooting

Even with the seven steps in place, a handful of recurring errors often undermine the analysis. The most damaging ones appear below.

Common Mistakes

• Relying on a single snapshot. A one-period aging report cannot distinguish a temporary spike from structural deterioration. The 3–6 month trend from Step 2 is what makes that distinction possible.
• Ignoring customer concentration. Aggregate bucket percentages can look healthy while a single large customer drives most past-due AR. The concentration ratio in Step 3 is the tool that surfaces this risk.
• Failing to investigate exceptions. Pooling a bankrupt customer’s balance with performing accounts produces a materially understated loss estimate. Every exception requires individual treatment.
• Using inconsistent bucket definitions. Mixing invoice-date aging with due-date aging across periods invalidates trend comparisons. Bucket definitions must be locked and applied consistently.
• Not documenting the credit-risk conclusion. An undocumented analysis will not withstand audit, lender review, or board scrutiny. The memo in Step 7 is the minimum acceptable deliverable.
• Overlooking expected credit loss under CECL. Under CECL, all receivables must carry an allowance estimate, including current, performing balances, and there is no probable recognition threshold. Skipping the allowance on current AR repeats the error flagged in Step 5 and remains non-compliant.

Watch Outs

• A declining allowance/AR ratio in a deteriorating aging environment signals under-provisioning rather than improved credit quality.
• In 2026, auditors are specifically challenging forward-looking adjustment documentation, zero-loss assertions on current receivables, and pool definitions that have not been refreshed since CECL adoption.
• A single oversized customer can distort DSO enough to make the entire receivables book appear weaker or stronger than it actually is.

Troubleshooting

• Historical loss data is thin or unavailable: Acceptable approaches include using industry-level loss data from credit bureaus or trade associations as a starting point and adjusting for entity-specific experience, or applying a qualitative overlay that explicitly addresses the lack of historical data. Thin loss history does not justify a zero rate; see the Step 5 discussion of supportable assumptions.
• Aging report does not reconcile to the GL: Pause the analysis and resolve the discrepancy before proceeding, because a reconciliation failure invalidates every downstream calculation.
• Bucket definitions differ from prior periods: Restate prior periods using the current definition before performing trend analysis.

Many of these mistakes reflect an underperforming accounting function or the absence of fractional CFO oversight. A structured review process with a qualified second party eliminates most of them before they reach the memo stage.

Have Condesa Review Your Process

How To Evaluate Progress

A credit-risk assessment process works when it produces consistent, repeatable outputs that decision makers can act on. You can gauge process maturity against the following indicators:

• Cleaner aging data. Bucket definitions stay locked, the aging report reconciles to the GL every period, and exception accounts are flagged before the close is finalized.
• Faster identification of deteriorating accounts. The trend table in Step 2 is completed within 24 hours of the period-end aging report, and accounts crossing threshold triggers are escalated the same day.
• Documented credit decisions. Every period produces a signed credit-risk memo filed in the close package, so no credit conclusion exists only in someone’s head.
• Consistent application of thresholds. The same bucket benchmarks, concentration ratio, and escalation triggers apply every period without renegotiation.
• Improved communication with sales and leadership. Sales leadership receives a concentration summary before extending new credit to top-5 past-due customers, and the board receives the key ratios from Step 6 in every financial package.

Process maturity guarantees decision readiness, which means you can answer a lender’s or auditor’s question about credit risk with a document rather than a conversation.

Assess Your Credit-Risk Maturity

Advanced Considerations And Next Steps

Once the seven-step framework runs consistently, several extensions can deepen the analysis and streamline the work.

• Integration Into The Monthly Close. The credit-risk memo should appear as a standard close deliverable instead of an ad hoc exercise. Embedding it into the close checklist ensures completion every period and creates a longitudinal record that auditors and lenders can review.
• Automation In QuickBooks Or NetSuite. Both platforms support saved searches and aging report exports that can feed a standardized expected loss spreadsheet. For NetSuite users, implementing CECL typically involves extracting aged receivables data via saved searches, performing calculations externally, and recording a periodic journal entry to adjust the allowance. Automating the data extraction step removes the most error-prone part of the process.
• Roll-Rate Analysis For More Sophisticated Loss Forecasting. Roll-rate analysis measures how balances move from one delinquency bucket to the next over time and can surface earlier warning signs than a static aging review because it detects changes in payment flow before they accumulate into visibly worse aging balances. For SMEs with sufficient historical data, roll-rate analysis becomes a natural upgrade from the static aging-schedule method.
• Cross-Border Considerations. Multinational SMEs face additional complexity. Foreign receivables are typically ineligible for ABL borrowing bases unless supported by credit insurance or a letter of credit, currency risk affects the dollar value of expected collections, and payment norms vary materially by country. A fractional CFO with cross-border experience is essential for SMEs with meaningful international AR exposure, and that is the gap Condesa Financial Group was built to fill.

If cross-border exposure or CECL documentation is straining your current finance function, fractional CFO support can close that gap. Condesa Financial Group provides that oversight at a nearshore rate built for SMEs.