By Kredcor Staff — Kredcor, South Africa’s Commercial Debt Recovery Partners.
Registered with the Council for Debt Collectors (Reg Nr 0016365/06) | 26+ years of commercial debt recovery | 2 October 2026
Most business owners treat credit risk management as part of collections — something that starts once an invoice is late. That’s backwards. By the time an invoice is overdue, most of the decisions that decide whether you get paid have already been made. Usually a salesperson made them while trying to close the deal.
Credit risk management is deciding who you sell to on credit, how much, on what terms and with what security. Then it means watching those accounts closely enough to act before a slow payer becomes a bad debt. It comes down to five moves: assess, limit, secure, monitor and act. For South African SME owners, credit managers and CFOs, those five moves matter more in late 2026 than they have for years.
Quick take
Credit risk management controls how much you could lose if a customer doesn’t pay. Vet every new account with a CIPC company search and a credit bureau report. Set a limit you can afford to lose. Take security, such as a director’s suretyship. Review your debtors weekly. Escalate on fixed dates, not promises.
What this guide covers
1. What credit risk management actually covers
2. Why it matters more in South Africa right now
3. The five moves of credit risk management
4. How to put a number on a customer’s risk
5. What South African law changes about credit risk
6. What we see on the accounts that go wrong
7. Troubleshooting: if this happens, try this
8. Another way to see it
9. Frequently asked questions
10. What to do next
11. Quick-action checklist
1. What credit risk management actually covers
What is credit risk management?
Credit risk management is how a business limits losses from customers who buy on credit and then pay late, pay less, or don’t pay at all. It looks at two things for every account: how likely the customer is to default, and how much you would lose if they did. Good credit risk management reduces both, without strangling sales.
How is it different from credit control?
Credit control is the day-to-day work: sending statements, making reminder calls and chasing overdue invoices. Credit risk management sits one level above it. It sets the rules credit control follows — who qualifies, the limit, the terms, the security, and when to escalate. If you want the operational side, we cover it step by step in our guide to building a rock-solid credit control system.
Put simply, credit control chases the money. Credit risk management decides how much money is exposed to chasing in the first place.
2. Why it matters more in South Africa right now
The trading climate has shifted under South African businesses this year.
Four numbers tell most of the story:
- Borrowing just got dearer again. On 23 September 2026 the South African Reserve Bank (SARB) raised the repo rate by 25 basis points to 7.25%, its second hike this year. That took the prime lending rate to 10.75% (Moneyweb). Customers running on an overdraft now pay more to carry stock — and your invoice competes with their bank for every rand.
- Business failures haven’t gone away. Statistics South Africa (Stats SA) recorded 1,601 liquidations between January and July 2026, 4.9% fewer than a year earlier (Vutivi Business, citing Stats SA). Fewer is good. It still means more than 200 companies a month — and a falling national count says nothing about your particular debtor.
- The state pays late, and that flows downhill. At the end of March 2026, national and provincial departments still owed suppliers R16.8 billion on 88,403 invoices older than 30 days. That’s according to National Treasury’s 30-day payment reports (compiled by Paidnice). If your customer supplies government, their cash flow problem can quickly become yours.
- Late payment is normal, not exceptional. Xero’s State of Late Payments research found that 91% of small businesses had invoices paid late, with overdue invoices settled an average of 18 days after terms. It is still widely cited, including in a May 2026 Business Day analysis of South Africa’s supplier economy.
What those numbers mean for your debtors book
Higher rates, steady liquidations and a slow-paying state all squeeze the same thing: your customers’ ability to pay you on time. The answer isn’t to stop giving credit. It’s to know exactly how much you have riding on each customer.
3. The five moves of credit risk management
We’ve seen credit risk frameworks work in five-person engineering suppliers and in national distributors. Every one of them comes back to the same five moves. The tools get more sophisticated as you grow. The moves don’t change.
Move one: assess before you agree
Start with a proper credit application. It should capture the full registered name, registration number, directors’ details, bank details, trade references, and signed consent to credit bureau enquiries and default listing. If yours still lives on paper, our guide to the paperless credit app shows how to digitise it properly.
Then verify what the customer told you. Run a company search with the Companies and Intellectual Property Commission (CIPC) to confirm the entity exists, is in business and has the directors it claims. Pull a commercial credit bureau report from a bureau such as TransUnion or Experian for judgments, defaults and payment history. For larger accounts, add a pre-legal solvency check: recent financials, a bank code, and a call to two trade references.
The classic “five Cs” still make a useful checklist. They are character (payment history), capacity (cash flow), capital (net worth), collateral (security) and conditions (their industry and the economy).
Move two: set a limit you can afford to lose
A credit limit isn’t a reward for a good customer. It is the most you are prepared to lose if things go wrong. Ask one blunt question: if this account never paid another cent, would payroll still run next month?
Watch how much of your book sits with one customer, too. Many credit teams cap any single customer at 10% to 20% of total debtors. Set limits per legal entity, not per group. A strong group name can sit on top of a thin subsidiary.
Move three: secure the exposure
Security turns a promise into something you can enforce. The most common tools in South African business-to-business (B2B) trade are a director’s suretyship, a deposit, retention-of-title clauses, bank guarantees and trade credit insurance. A suretyship must be in writing and signed by the surety. Build it into the credit application rather than asking later, because a request made once a customer is struggling rarely lands well.
Move four: monitor as if the account can change overnight
Accounts do change overnight. Review your age analysis weekly, not monthly, and track days sales outstanding (DSO) per customer, not only as a company average. Re-pull a credit bureau report whenever you see a warning sign: a slipping payment pattern, a request for longer terms, or a director change at CIPC. Our guide to early detection of a problematic debtor lists the seven red flags our team watches for.
Move five: act on fixed dates
Decide your escalation path before you need it, then follow it for every customer — large ones included. A typical path runs from soft collections and early delinquency management, to a stop on further supply, to a final demand notice. From there it moves to an attorney’s letter of demand (LoD), a signed acknowledgement of debt (AOD) with a commercial payment arrangement, and finally handover for pre-litigation negotiation.
“The bad debts we see rarely start with a bad customer. They start with a good customer whose limit nobody re-checked.”— Kredcor credit risk team
4. How to put a number on a customer’s risk
How do you calculate expected credit loss on a trade debtor?
Use a simple formula borrowed from banking: expected loss = probability of default × exposure × loss if they default. Probability of default is your honest guess at the chance the customer fails within a year. Exposure is the most they could owe you. Loss if they default is the share you wouldn’t get back, even after suretyships and collection.
Here’s a worked example. A customer has a R400,000 limit. Their bureau report and payment history suggest roughly a 5% chance of default. If they did fail, you’d expect to recover about 40%, so you’d lose 60%. Expected loss is 0.05 × R400,000 × 0.6 = R12,000. If your gross margin on that account is R300,000 a year, that’s a risk worth taking.
Now suppose sales doubles the limit to R800,000 while the customer’s payments slip, pushing the default chance to 15%. Expected loss jumps to R72,000 — six times higher, from one approval nobody questioned. The numbers don’t need to be precise. They need to make the trade-off visible.
Turn the number into a simple risk grade
Most SMEs don’t need a scoring model.
A four-grade system, reviewed regularly, does the job:
| Grade | What it looks like | Terms that usually fit |
|---|---|---|
| A — low risk | Clean bureau report, pays on time, established business | Standard terms; review the limit once a year |
| B — moderate | Minor bureau blemishes or occasional late payment | Standard terms, capped limit, director’s suretyship |
| C — elevated | Slipping payments, young business or a thin balance sheet | Shorter terms or a deposit; review monthly |
| D — high | Judgments, default listings or a history of broken promises | Cash on delivery, or credit only against a guarantee |
If your company reports under full IFRS (International Financial Reporting Standards), IFRS 9 already expects you to provide for expected credit losses on trade receivables. A graded book like this makes that provision far easier to defend to your auditor.
5. What South African law changes about credit risk
South African law shapes credit risk management in ways a generic guide won’t tell you. The National Credit Regulator (NCR) enforces the National Credit Act 34 of 2005 (NCA). But the Act doesn’t apply where the customer is a company or close corporation with assets or annual turnover of R1 million or more. Most established trade customers fall outside it. Sole proprietors and very small close corporations can fall inside it. For those customers, a Section 129 default notice may be required before you enforce, and you may have registration obligations of your own. Check the customer’s legal status on the credit application, not after the account goes bad.
Three more rules matter day to day. Under the Prescription Act 68 of 1969, most commercial debts prescribe after three years. A signed acknowledgement of debt or service of a summons interrupts that clock — a letter of demand on its own does not. The Protection of Personal Information Act (POPIA) means your consent wording for bureau enquiries and listings must be clear and on file. And anyone collecting debts for a fee must be registered with the Council for Debt Collectors (CFDC) under the Debt Collectors Act 114 of 1998.
Finally, consider business rescue. If a debtor enters it under Chapter 6 of the Companies Act 71 of 2008, a moratorium stops most legal action against the company. A director’s suretyship can generally still be pursued, which is one more reason to take one at the start.
6. What we see on the accounts that go wrong
Kredcor has recovered commercial debt for South African businesses since 1999. After more than 26 years, the files that cross our desks show the same handful of credit risk failures again and again.
Paperwork that was never finished. When we analysed overdue B2B accounts with documentation gaps in 2025, 68% of them traced back to an incomplete or outdated paper credit application. A missing suretyship or an unsigned page of terms rarely matters on day one. It matters a great deal on day 120.
Limits that drifted. Our team’s experience is that the most painful losses come from long-standing customers, not new ones. The limit crept up over years of good trading, and nobody re-ran a bureau report when the payments started to slow.
Waiting too long to escalate. We consistently find that debts handed over within about 60 days recover far better than debts that sat for 120 days or more. Time rarely improves a struggling debtor’s position. It just moves you further down their list of creditors.
That last point is why we built our own service around early, relationship-preserving debt recovery. Each client gets a dedicated Credit Risk Manager and regular reporting, and our pre-legal work runs on a no-success, no-fee basis.
7. Troubleshooting: if this happens, try this
- If sales keeps overriding credit limits, make the override visible. Require written approval from finance for any order over limit, and consider paying commission on collected sales rather than invoiced ones.
- If a reliable customer suddenly asks for 60-day terms, treat it as information, not admin. Re-pull their credit report, ask for recent management accounts, and offer a staged increase backed by a suretyship.
- If one customer makes up more than a fifth of your debtors book, reduce the exposure you carry alone. Ask about trade credit insurance or a bank guarantee, shorten the terms, or invoice in smaller, more frequent batches.
- If a customer refuses to sign a suretyship, don’t argue — price the risk. Take a deposit, cut the limit, or move them to shorter terms until they’ve built a track record.
- If the bureau report is clean but payments are slipping, trust your own ledger. Your payment data is fresher than any bureau’s, so downgrade the account and start your early-warning steps now.
- If a director stops answering and the company goes quiet, run a fresh CIPC search for new companies with the same directors. Start debtor skip tracing and director tracing within weeks, not months.
8. Another way to see it
Some finance teams argue that credit risk management, done too well, kills growth. They have a point. A business with zero bad debt is almost certainly turning away profitable customers, and competitors who extend sensible credit will win that trade.
Our view: the goal isn’t zero risk. It is chosen risk. Decide how much bad debt your margins can carry, grade customers honestly, and then sell confidently inside those lines. Credit risk management done properly gives your sales team permission to say yes — it doesn’t only tell them when to say no.
9. Frequently asked questions
What is the difference between credit risk management and credit control?
Credit risk management sets the rules: who gets credit, how much, on what terms and with what security. Credit control applies those rules day to day by invoicing, reminding and following up. You need both, even if one person does both jobs.
How often should we review customer credit limits?
Review every limit at least once a year. Review it at once when something changes: slower payments, a request for longer terms, a director change or a new judgment. High-risk accounts deserve a monthly look.
Does the National Credit Act apply to business-to-business credit?
Usually not. The NCA doesn’t apply where the customer is a juristic person — a company or close corporation, for example — with assets or annual turnover of R1 million or more. Sole proprietors and very small entities can fall inside it, so check each customer’s legal status when you open the account.
When should a credit manager hand an account to a debt collector?
Hand it over once your own escalation steps have failed, usually between 45 and 90 days overdue. Act straight away if you see signs of insolvency or the debtor goes silent. Use a collector registered with the CFDC, and ask whether it works on a contingency, no-success, no-fee basis.
10. What to do next
Your next question is probably where to start. Don’t try to re-grade every account at once. List your ten largest debtors by exposure, give each one an honest grade from A to D, and work out a rough expected loss for each. That one exercise usually shows exactly where your risk sits — and it’s rarely where people expect.
Then fix the front door. Update your credit application so every new account arrives with bureau consent, listing consent and a signed suretyship. Once that’s done, decide your escalation dates in writing, so your team isn’t improvising when the next large account goes quiet.
11. Quick-action checklist
- Run a CIPC search and a fresh credit bureau report on your five largest debtors this week.
- Grade your top ten accounts A to D and calculate a rough expected loss for each.
- Flag any customer above 15% to 20% of your debtors book and decide how to reduce that exposure.
- Add suretyship, bureau-consent and listing-consent clauses to your credit application.
- Write down your escalation dates — final demand, letter of demand, handover — and apply them to every customer.
Keep the habit going
Credit risk management isn’t a once-off project. It’s a habit that makes slow payers rarer and bad debts smaller. Some accounts will still slip past what your own team can fix. When that happens, experienced debt collectors in South Africa can take over the pre-legal work while you keep the customer relationship intact.
For more practical guidance on credit risk, cash flow and South African debt law, browse the full library of Kredcor articles.
Worried about an account that’s starting to slip?
Kredcor — registered with the CFDC (Reg Nr 0016365/06). No success, no fee.
Call 010 500 4640 or 083 518 0511, or visit www.kredcor.co.za/contact.
About the author: Kredcor Staff write on behalf of Kredcor Khuluma CC, a family-owned B2B debt recovery firm founded in Alberton, Gauteng, in 1999 and registered with the Council for Debt Collectors (Reg Nr 0016365/06).
Sources: South African Reserve Bank MPC decision of 23 September 2026, as reported by Moneyweb; Statistics South Africa, Statistics of liquidations (January–July 2026), as reported by Vutivi Business; National Treasury 30-day payment reports (Q4 2025/26), as compiled by Paidnice; Xero, State of Late Payments, as cited in Business Day, 2 May 2026; Kredcor internal analysis of overdue B2B accounts, 2025; National Credit Act 34 of 2005; Prescription Act 68 of 1969; Debt Collectors Act 114 of 1998; Companies Act 71 of 2008; Protection of Personal Information Act 4 of 2013.
Disclaimer: This article is general information, not legal or financial advice. Speak to a qualified attorney, your auditor or a registered debt collector about your specific situation.