traditional credit rating uses a set of macro and micro factors (country of incorporation political stability, economy, etc. ) and assigns subratings via a set a scorecards, based on the company's specifics, the final rating being an analyst consensus and essentially an aggregation of the subratings.
this is updated when some inputs change (e.g. new annual statement), analysts meet and discuss.
c.f. Moody's methodology papers here, note each methodology paper is slightly different, by industry type, etc.
now, quantitatively, the traditional approach is to model the 'distance to default' as the difference between assets and liabilities (based on if liabilities > assets, the company will default), and asset volatility (typically mapped from equity vol for publicly traded firms), then map that to a probability of default based on a database of historical defaults with the corresponding balance sheet metrics.
recommend the reading expected default frequency methodology summary
an additional note is that in practice at rating agencies and banks alike, pressing the trigger for a downgrade is much easier as soon as something is wrong.
risk practitioners often praise being "conservative", and on the other hand, any upgrade has to be justified by several quarters/years of improved performance, hence much slower to actually happen.