APRA APS 113: the internal ratings-based (IRB) approach to credit risk

Prudential Standard APS 113 *Capital Adequacy: Internal Ratings-based Approach to Credit Risk* is the APRA standard that lets an authorised deposit-taking institution (ADI) use its own internal models — rather than standardised risk weights — to calculate the regulatory capital it must hold against credit risk. In short: APS 113 is the rulebook for the "advanced" or model-based path to credit risk capital, and only ADIs that APRA has formally accredited may use it.

It sits within APRA's broader capital framework for ADIs and is the IRB counterpart to APS 112, which sets the standardised approach. APS 113 specifies how internal estimates of risk parameters feed into capital, what an ADI must prove to gain and keep IRB accreditation, and the governance that must surround those models.

What APS 113 is

APS 113 implements the Basel internal ratings-based methodology in the Australian context. Under the IRB approach, an ADI estimates key risk parameters for its credit exposures and applies APRA-prescribed risk-weight formulas to those estimates to derive risk-weighted assets (RWA) for credit risk.

The core parameters are:

• Probability of default (PD) — the likelihood a borrower defaults over a one-year horizon.
• Loss given default (LGD) — the proportion of an exposure expected to be lost if default occurs.
• Exposure at default (EAD) — the amount expected to be outstanding at default.
• Maturity (M) — the effective remaining tenor of the exposure.

An ADI must apply a foundation IRB (FIRB), advanced IRB (AIRB), retail IRB or supervisory slotting approach to a given asset class, in line with its IRB approval. Broadly, under FIRB the ADI estimates PD and uses prescribed values for other inputs, while under AIRB it also estimates LGD and EAD. The IRB asset classes are corporate (including four specialised lending sub-asset classes), sovereign, financial institution and retail (four sub-asset classes). Equity exposures, non-standard retail residential mortgages and several other items are excluded from APS 113 and remain under APS 112.

The primary source is the standard itself on the APRA website. The version in force commenced on 30 June 2026. It is accompanied by the non-binding practice guide APG 113 that explains APRA's expectations.

Who APS 113 applies to

APS 113 applies to ADIs regulated under the *Banking Act 1959* that either:

• have APRA approval to use an IRB approach to credit risk for regulatory capital purposes; or
• are seeking such approval.

In practice, IRB accreditation has been confined to a small number of large, sophisticated ADIs — historically the major banks and a handful of others — because the data, modelling capability and governance required are substantial. Most ADIs, including the majority of mutuals and smaller banks, use the standardised approach under APS 112 instead and are not subject to APS 113.

An ADI cannot simply elect into the IRB approach. It must apply to APRA and satisfy the accreditation requirements before any internal model output may be used for regulatory capital.

How the IRB approach works

Once accredited, an ADI runs its credit exposures through its internal rating systems to produce PD, LGD and EAD estimates. Those estimates are inserted into the risk-weight functions set by APRA in APS 113 to generate RWA, which in turn drives the capital ratios reported under the broader framework (APS 110 *Capital Adequacy*).

Two features are central:

• Risk estimates must be conservative and well-evidenced. APRA expects estimates to be grounded in long-run data, to include appropriate margins of conservatism where data is limited, and to reflect downturn conditions for LGD where required.
• Stress and forward-looking risk must be considered. The standard requires an ADI to identify possible events or future changes in economic conditions that could adversely affect its credit exposures and to factor these into its internal capital adequacy assessment.

The model output is not the end point. It feeds into capital ratios that must remain above APRA's minimum requirements and buffers at all times.

Approval, accreditation and the capital floor

Accreditation is a gating process. To obtain IRB approval an ADI must demonstrate, to APRA's satisfaction, that its rating systems, data, validation and governance meet the standard — both at initial implementation and on an ongoing basis. APRA may impose conditions, require a parallel-run period, and can withdraw or vary approval.

A key design feature of the post-Basel III framework is a capital floor: RWA calculated under the IRB approach cannot fall below a prescribed percentage of what they would be under the standardised approach. This prevents internal models from producing capital outcomes that are too low relative to the standardised benchmark. Under APS 110 (Attachment A, paragraph 4), an IRB ADI's total RWA must be no lower than 72.5% of total RWA calculated using the standardised approaches.

APRA has updated APS 113 in line with its revised ADI capital framework; the version in force commenced on 30 June 2026. Always work from the current version on the APRA website for live obligations and effective dates.

Governance, models and ongoing obligations

IRB accreditation carries continuing obligations that go well beyond the maths. APS 113 requires an accredited ADI to maintain a sound risk-management framework around its rating systems, including:

• Independent review and validation — the rating systems and operations must be reviewed at least annually by internal audit or an equally independent function, covering the estimation of PD (and, where relevant, LGD and EAD) and adherence to APS 113, with findings documented.
• Board and senior management oversight — the rating systems must be embedded in actual credit decision-making and risk management (the "use test"), not run only for regulatory reporting.
• Data quality and retention — robust, documented data supporting parameter estimation and back-testing.
• Model governance — documented model design, approval, monitoring and change-control processes.

These obligations connect closely to broader risk-management duties. An ADI's model risk and validation activities should sit within its overarching framework under CPS 220 Risk Management, which requires a board-approved risk management framework and an independent risk function across the institution. APS 113's specific requirements for credit risk models are best read alongside those institution-wide obligations and APRA's wider expectations for financial services prudential governance.

What ADIs should do

For an ADI on, or pursuing, the IRB approach:

1. Confirm which approach applies — IRB (FIRB, AIRB, retail IRB or slotting) only if accredited; otherwise APS 112 standardised.
2. Map the capital floor impact — model the IRB RWA against the standardised floor and understand the binding constraint.
3. Strengthen validation — ensure independent review covers model performance, the use test, and compliance with APS 113.
4. Maintain conservatism — document margins of conservatism, downturn LGD and data limitations.
5. Keep change control tight — material model changes and reclassifications typically require APRA notification or approval.
6. Reconcile with CPS 220 — ensure model risk is captured in the enterprise risk management framework.

Common pitfalls

• Treating IRB as a permanent right. Accreditation can be conditioned, varied or withdrawn; ongoing compliance is mandatory.
• Failing the use test. Running models for capital reporting while credit decisions rely on other tools is a recurring weakness APRA scrutinises.
• Underestimating the floor. Assuming IRB always produces lower capital can mislead planning once the standardised floor binds.
• Weak validation independence. Validation performed by, or too close to, the model-development team undermines the independent-review requirement.
• Relying on superseded versions. APS 113 has been revised; using an out-of-date version risks applying the wrong risk weights or thresholds. Check the current standard with APRA before acting.