What makes credit risk more difficult for quantification and backtesting than market risk?