Outline how validation, independent review, and policies and procedures each feature in stress testing governance.
The idea
Three elements hold the governance of stress testing together. Validation tests whether the models, assumptions and data are conceptually sound and work as intended, through checks on methodology, back-testing of components where possible, sensitivity tests and ongoing monitoring. It must be done by qualified people independent of the developers. Independent review is a wider challenge to the whole programme, its scenarios, assumptions, results and use. It is carried out by staff or outsiders who were not involved in building or running it, so that management is not marking its own work. Policies and procedures are the written rules: objectives, roles, scenario design, methodology, data, frequency, escalation and documentation, updated whenever the business or models change. The common mistake is mixing these up. Validation is about the model, independent review is about the programme, and written policy is what both are tested against.
A practice question
Which statement about policies and procedures for stress testing is most accurate?
- They are set once when the programme is approved and are not changed unless the board decides to rewrite the whole programme.Why not: Policies and procedures must be updated as business, models and conditions change.
- They are needed only for banks that are subject to supervisory stress tests.Why not: Every institution that stress tests needs documented policies and procedures.
- They prescribe the specific scenarios that must be used in every future exercise.Why not: They set out the framework and process, not a fixed list of scenarios for all time.
- They document objectives, roles, methods, data, frequency and escalation, and are updated as the business changes. - correct
Written policies and procedures give the programme consistency and are the standard against which validation, review and audit are performed. They must be kept up to date.
A harder one
What distinguishes independent review of a stress testing programme?
- A challenge of the programme, scenarios and results by staff or outsiders not involved in building or running it. - correct
- It is performed by the model developers to confirm that they implemented the design correctly.Why not: Developers reviewing their own work is not independent.
- It is performed by the business line that owns the portfolio, because they know the exposures and the risks best.Why not: The business line has an interest in results, so its review would not be independent.
- It is performed once at launch and does not need to be repeated.Why not: Independent review should be repeated periodically.
Independence is the point: reviewers must not be responsible for building or running the stress tests so that they can give objective challenge.
The hardest tier
A bank expands into a new business line and changes its stress testing methodology. Which governance step is most important?
- Validate the models only if the new results prove unacceptable to the board.Why not: Validation should not depend on whether results are liked.
- Wait for the next annual internal audit before using the revised models.Why not: Audit is periodic; new models need validation before use.
- Update the policies and procedures, and have the revised models validated and independently reviewed before use. - correct
- Treat the change as routine, since validation covers only the original build of the models and does not need to be repeated.Why not: Material changes need new validation and updated documentation.
A material change in business or method means the existing documentation and validation are out of date. Policies are updated and the changed models validated and reviewed before use.
In the app: 6 practice questions on this outcome, spaced review that brings it back before you forget it.
Start free →More in Stress Testing
- Outline why stress testing is used as a risk management tool.
- Describe where stress testing sits alongside other risk measures, especially when it is done enterprise-wide.
- Compare how stressed VaR and stressed ES are determined with the way traditional VaR and ES are determined, describing the advantages and disadvantages of the stressed measures.
- Explain what must be weighed, and what proves difficult, when scenarios for stress testing are developed and stress testing models are built.
- Give an example of regulatory stress testing and describe what reverse stress testing is.
- Set out what the internal audit function, senior management and the board of directors each answer for when stress testing is governed.
- Outline the Basel stress testing principles that apply to banks when they put stress testing into practice.