Learn / Models
Why credit scorecards still use logistic regression, and where ML fits
XGBoost and neural nets can rank customers better on a test set, yet most scorecards in lending still run on logistic regression. The reason is not habit. A scorecard has to do a job: be read by a credit committee, defended to an auditor, kept stable as the book changes, and maintained by a small team. This guide explains why logistic regression fits that job, where machine learning helps, and how to monitor a scorecard with PSI, CSI and Gini.
The short answer
The best model in regulated lending is often the one you can explain, defend and maintain, not the one with the highest Gini. A small gain in ranking power that costs you explainability and stability is often a bad trade.
Six reasons logistic regression keeps winning
- Explainable by design. Each variable's contribution is visible, so when a committee or auditor asks why a customer was declined, you have a clear answer and reason codes.
- Scorecard-friendly. With weight of evidence (WoE) binning, coefficients convert neatly into points that underwriters, collections teams and business heads can all read.
- Calibrated probabilities. The output is a probability of default (PD), so it feeds pricing, limit setting, expected credit loss and cut-off strategy directly.
- Stable over time. Simple, monotonic relationships tend to hold up better than complex interactions when the portfolio mix shifts.
- Works with less data. For new products, new-to-credit segments or smaller lenders, it performs well without very large datasets.
- Easy to govern. Validation, monitoring and recalibration are straightforward, because the model is small enough to inspect.
How a scorecard is built
- Select variables using information value (IV), correlation and multicollinearity checks.
- Bin each variable and calculate its weight of evidence for every bin.
- Fit a logistic regression on the WoE values.
- Scale the result to points and attach reason codes.
- Set cut-offs for approve, review and decline using the portfolio's risk and volume targets.
Weight of evidence for a bin is the natural log of the share of good accounts in the bin divided by the share of bad accounts in the bin. Information value adds up, across bins, the gap between those shares multiplied by the WoE.
| Bin A, high scores: 30% of goods, 10% of bads | WoE 1.10, IV part 0.22 |
| Bin B, middle scores: 40% of goods, 30% of bads | WoE 0.29, IV part 0.03 |
| Bin C, low scores: 30% of goods, 60% of bads | WoE -0.69, IV part 0.21 |
| Total information value | About 0.46 |
A common rule of thumb reads IV below 0.1 as weak, 0.1 to 0.3 as medium, 0.3 to 0.5 as strong, and above 0.5 as suspicious and worth checking for leakage. Treat these as starting points and set your own policy.
Where machine learning fits
Machine learning has a real place. It is not always the champion model, but it is useful for:
- Finding signal. A tree-based model can show which variables and interactions the scorecard misses.
- Segmentation. It can suggest where one scorecard should be split into two.
- Challenger benchmarks. Comparing a challenger's Gini with the champion's tells you how much ranking power is left on the table.
- Settings where explanation matters less, such as some fraud and collections uses, subject to your own policy.
Before a challenger replaces a champion, check its gain on an out-of-time sample, its stability across months, and whether you can give a reason for every decision. If the gain is small and the explanation is weak, keep the champion.
How to monitor a scorecard: PSI, CSI and Gini
Population stability index (PSI) compares the score distribution today with the distribution at development. Characteristic stability index (CSI) does the same for each input variable, so it points to which variable moved. Both are calculated across the same bins.
| Measure | What it compares | Common rule of thumb |
|---|---|---|
| PSI | Score bands now vs development | Below 0.10 stable, 0.10 to 0.25 watch, above 0.25 investigate |
| CSI | One variable's bins now vs development | Same bands, used to find the variable that moved |
| Gini decay | Gini on a recent matured cohort vs development Gini | A steady fall means rank-ordering is weakening |
| Development: 30%, 40%, 30% | Current: 20%, 40%, 40% |
| Band 1 term | (0.20 - 0.30) x ln(0.20 / 0.30) = 0.041 |
| Band 2 term | 0 |
| Band 3 term | (0.40 - 0.30) x ln(0.40 / 0.30) = 0.029 |
| PSI | About 0.07, so stable |
One mistake causes most monitoring errors. Freeze the bin edges from the development sample. If you recalculate cut points on each month's data, PSI will look stable when the population has actually moved.
Checks before you trust AI-written monitoring SQL
- The bins come from the development sample, not from the current month.
- Empty bins are handled. A zero share breaks the log, so add a small floor or flag the bin.
- Both periods use the same score bands and the same product scope.
- Gini is measured only on loans that have had enough time to show a default outcome.
- No loan or customer is counted twice.
The paid Bucketwise tools for stability tests and ongoing model monitoring are planned and not open yet. You can join the waitlist on the home page.
What to show the committee
- One chart of Gini against the development value over recent months.
- PSI by month, with the 0.10 and 0.25 lines drawn.
- The top three CSI movers and a one-line reason for each.
- Override and approval rates, and whether they changed.
- A clear ask: keep, recalibrate or rebuild.
Try it on your own tables
The free tools give you the prompt, the checks and how to present the result. You enter table names only.
See the free toolsFrequently asked questions
Do credit scorecards still use logistic regression?
Yes. It remains the common choice for application, behavioural and collection scorecards, because it is explainable, gives calibrated probabilities and is easy to validate and monitor.
What is a good PSI value?
A common rule of thumb is below 0.10 for stable, 0.10 to 0.25 for a moderate shift worth watching, and above 0.25 for a significant shift that needs investigation. Set your own thresholds in your model policy.
What is the difference between PSI and CSI?
PSI compares the distribution of the final score between two periods. CSI compares the distribution of one input variable. Use PSI to see that something moved and CSI to find which variable moved.
Why not use XGBoost as the main scorecard?
It can rank better, but it is harder to explain, harder to keep stable as the mix changes and harder to govern. Many lenders use it as a challenger or for variable discovery and keep a logistic regression as the champion.
Does the RBI require logistic regression?
I am not aware of a rule that requires a specific method. The expectation is that models are explainable, validated and governed. Confirm your obligations against the current RBI guidance and your model risk policy.
Keep reading
How to check AI-written credit-risk SQL before you trust it
AI tools write SQL that runs but may be wrong. Ten checks to run on any credit-risk query: row counts, duplicates, DPD edges, bucket totals and a hand trace.
PortfolioVintage analysis: how to read a vintage curve
Vintage analysis groups loans by the month they were disbursed and tracks how they perform over time. Learn to build a vintage table and spot weak cohorts early.
PortfolioRoll rate analysis: how to read a roll-rate matrix
A roll-rate matrix shows where loans in each bucket end up next month. Learn to build one, read it, and use it to forecast how many loans reach 90+.