Pick out the elements that together make a model risk management process effective.
The idea
An effective model risk management process rests on three connected pillars. These are sound model development, implementation and use, rigorous validation, and strong governance, policies and controls. Governance starts with the board and senior management. They set risk appetite, approve policies and receive reporting on aggregate model risk. Policies define roles for ownership (the business that builds and uses the model), control (independent validation and risk oversight) and compliance (adherence to policy). A comprehensive model inventory lists models in use, in development and recently retired, with owners, purpose and validation status. It supports assessment of risk in aggregate, including links between models. Internal audit checks that the whole framework works. The unifying idea is effective challenge. This is critical analysis by objective, informed people with the competence, influence and incentives to force changes. Exam traps confuse who owns models with who validates them, and who is ultimately accountable.
A practice question
Which party is ultimately responsible for model risk management in a bank, including setting risk appetite and approving key policies?
- The board of directors and senior management. - correct
- The model developers who built each model.Why not: Developers are model owners with day-to-day duties, but they are not accountable for the framework.
- Internal audit, which reviews the framework independently.Why not: Audit evaluates the framework independently and does not own it.
- The model validation team.Why not: Validators provide challenge and assessment, but accountability for the framework sits above them.
The board and senior management set the tone, approve the policies and are accountable. Developers own models, validators challenge them and audit checks the whole framework.
A harder one
Under the ownership, control and compliance roles in a model risk framework, which activity belongs to the control role rather than to model owners?
- Building the model and ensuring that it performs as intended day to day.Why not: Describes the owner role, which includes development, use and day-to-day performance.
- Using the model output in business decisions and documenting its use.Why not: Also an owner activity, since owners are the business users of the model.
- Confirming that staff follow the written policies and procedures across the bank and reporting any breaches.Why not: This is the compliance role, which checks adherence to policy rather than model assessment.
- Independent validation and limits on model use where validation raises concerns. - correct
Ownership covers development and use, control covers independent validation and oversight, and compliance covers adherence to policy.
The hardest tier
A bank's model validation team reports to the head of model development, and its bonuses depend partly on the development team's satisfaction with reviews. Which requirement of effective challenge is most directly compromised?
- Competence: the validators lack the technical expertise needed to review the models and their assumptions.Why not: Nothing in the scenario questions the validators' skills; the problem is structural.
- Independence, influence and incentives: validators have little reason or power to challenge developers. - correct
- Documentation: model developers fail to record assumptions and limitations.Why not: The scenario concerns reporting lines and pay, not the quality of documentation.
- Inventory completeness: models are missing from the bank's model register.Why not: The scenario describes reporting and bonus structure, which does not affect the completeness of the register.
Effective challenge needs competence, influence and the right incentives. A reporting line and pay structure tied to the people being challenged undermines independence and incentives.
In the app: 6 practice questions on this outcome, spaced review that brings it back before you forget it.
Start free →