Model Risk Management Best Practices A Substantial Focus on Definition, Governance Best Practices and an Emphasis on Model Validations By KAITLYN E. GASPER, CAMS, CFE, Vice President, Principal, Risk Advisory, S.R. Snodgrass PC INTRODUCTION According to supervisory guidelines, models refer to “a quantitative method, system or approach that applies statistical, economic, financial or mathematical theories, techniques and assumptions to process input data into quantitative estimates.” While models with less complexity have been used for several years, as the banking industry has moved forward over the past 20 years or so, it has become increasingly complex, and models have become more prevalent for managing risk, operational efficiency and key financial estimates. Our goal is to address how to identify the models currently utilized by your institution, establish a framework for managing model-related risks and discuss the importance of an effective validation program. MODEL INVENTORY In order to properly manage model risk, management must ensure all models currently used by the bank are identified, assess their risk to the institution and apply appropriate mitigation procedures, including governance, training, succession and model validation. When identifying models utilized by the institution, all areas of the bank must be considered, including Bank Secrecy Act/anti-money laundering (BSA/AML), asset liability management/interest rate risk (ALM/IRR), current expected credit losses (CECL) and automated valuation models (AVM), among others. As the types of models used are so diverse, it can be difficult to ensure all models are properly identified. After identifying each model, assessing them for their risk to the institution is a key measure to make sure the model owner(s) have the requisite knowledge and experience to operate the model, training is up to date, the model has been validated when applicable, and known issues or limitations are resolved. We frequently see institutions manage each model within their own silo with inconsistent application of risk mitigation procedures. As a result, the identification of the need for additional training, validation, etc., is the result of comments from regulatory examinations. Management should make sure to be proactive in this area as models become more relied upon within more aspects of the institution. GOVERNANCE AND POLICY As with all key management functions, governance is a critical aspect of model risk management as it establishes an effective environment for models to be managed. Making sure there are key lines of authority from model users/owners to senior management to the board of directors will allow for effective and timely reporting of problems or complications. Institutions can consider the need to identify a risk officer or similar position and/or risk committee to ensure models are discussed and inventoried. Adopting a model risk management policy should also be a priority for the board and management, identifying roles and responsibilities, validation/ testing expectations for each model, vendor management for any third-party involvement, reporting procedures and expectations for the resolution of any issues identified. It should provide guidance and acceptable procedures for management to ensure risk management procedures are consistent with the tolerance established by the board of directors. The bank should also ensure the internal audit’s involvement in assessing whether or not those charged with the day-to-day aspects of the model risk management policy are adhering to those requirements, including retention of all supporting documentation of testing the model, accurate reporting to senior management and the board, timely clearing of any significant validation findings, and adherence to vendor management requirements. Without an effective policy, we frequently see that management of each model is, at best, inconsistent; however, we generally see that a majority of models in use are not considered part of the overall risk management framework. IMPORTANCE OF A MODEL VALIDATION Model validations are an integral part of model risk management. Model validations should be performed, when 21 WEST VIRGINIA BANKER
RkJQdWJsaXNoZXIy MTg3NDExNQ==