This paper considers a simple model of credit risk and derives the limit distribution of losses under different assumptions regarding the structure of systematic and idiosyncratic risks and the nature of firm heterogeneity. The theoretical results obtained indicate that if firm-specific risk exposures (including their default thresholds) are heterogeneous but come from a common parameter distribution, for sufficiently large portfolios there is no scope for further risk reduction through active credit portfolio management. However, if the firm risk exposures are draws from different parameter distributions, say for different sectors or countries, then further risk reduction is possible, even asymptotically, by changing the portfolio weights. In either case, neglecting parameter heterogeneity can lead to underestimation of expected losses. But, once expected losses are controlled for, neglecting parameter heterogeneity can lead to overestimation of risk, whether measured by unexpected loss or value-at-risk. The theoretical results are confirmed empirically using returns and credit ratings for firms in the U.S. and Japan across seven sectors. Ignoring parameter heterogeneity results in far riskier credit portfolios.