In order to be compliant with the Basel regulations and the upcoming International Financial Reporting Standard 9, banks need two probabilities of default (PDs): point-in-time (PIT) and through-the-cycle (TTC). The existing methodologies assume that banks already have a customer-specific hybrid PD, which is then adjusted to PIT and TTC. We avoid this assumption and focus instead on a two-step process to obtain a PD, namely, rating assignment and calibration. In the first step, we propose a methodology for constructing TTC rating grades and assessing the resulting degree of PIT-ness. For calibration, we let the rating-grade default threshold be stochastic. This move enables us to quantify the impact of estimation errors, provides a justification for the size of a regulatory margin of conservatism and has direct implications for validation tests. We illustrate our proposals on a sample portfolio of corporate customers, although we believe these ideas should be applicable in retail too.