In the run up to the 2008 financial crisis, many securities that were risky were rated much higher, at say, AAA. Raghuram Rajan in his book "Fault Lines" argues that this could does not necessarily have to arise from maleficence on the part of rating agences:
Roughly 60 percent of all asset-backed securities were rated AAA during the lending boom, whereas typically less than 1 percent of all corporate bonds are rated AAA. How could this be, especially when the underlying assets against which the securities were issed were subprime mortgage-backed securities. Was this a sham perpetrated by the rating agencies?
Theory suggests it did not have to be a sham. In certain circumstances, a significant percentage of the securities issued against a package of low-quality loans can be highly rated. An example and some simple probability analysis can make the point. Suppose two mortgages, each with a face value of \$1 and a 10 percent chance of total default, are packaged together. Suppose further that the investment bank structuring the deal issues two securities against the package—a junior security with face value of \$1 that bears the brunt of losses until they exceed $1, and a senior security that bears losses after that. The senior security suffers losses only if both mortgages default. If mortgage defaults occur independently (that is, they are uncorrelated), then the senior security defaults only 1 percent of the time. This is the magic of combining diversification with tranching the liabilities—that is, creating securities of different seniority. Put a sufficient number of subprime mortgages together from different parts of the country and from different originators, issue different tranches of securities against them, and it is indeed possible to convert a substantial quantity of the subprime frogs into AAA-rated princes, provided the correlation between mortgage defaults is low.
How does this "convert" a substantial quantity of the subprime securities into AAA-rated securities -- the individual tranches are still rated according to their risk levels, right?