NOT FASHION MODEL RISK

It can be risky to be a fashion model. Dangers are everywhere and can include falling off a catwalk, unhealthy eating, having one's picture stolen and posted on the internet, or being ridiculed in the press for what they are wearing. To be sure, it is tough to be a fashion model, but in the banking industry, a different sort of modeling can also be tough. While not nearly as sexy or beautiful as the fashion model variety; model risk in banking is important. That is because financial models are used for so many critical bank functions that include underwriting, valuation, pricing bonds, managing interest rate risk, calculating capital, risk management and a host of others. Whether simple or complex, these financial models are ubiquitous in banking, so they need to be managed carefully. That is one key reason regulators have focused some energy here. They want bankers to understand not only where model risk may be present in the bank, but also to take specific and strong steps to manage it. As part of this focus, regulators expect banks to be able to identify sources of model risk, understand and measure the magnitude of those risks and have a process in place to manage them. Put another way, different models can and will result in different risks for the bank, so you need to manage the risk of each model around its own unique profile. To get started, you will need to identify all the models you have operating in or supporting the bank. These should include models you control directly and those used on an outsourced basis. Model definition can vary, but they can range from simple spreadsheets to complex multifaceted calculation engines. To determine whether or not you need to include something on your list, one quick way is to focus on the bigger picture first. The key is not to get bogged down in the definitional aspects of what is and is not a model, but rather to focus energies on asking whether it could have a material impact on your reputation (if the results were incorrect and were used); whether decisions based on it could result in losses; or whether the model could increase the risk of the management team making poor business decisions (if it were incorrect). If the answer to any of these is yes, keep it on the list. Now that you have a list, the next step is to have a structured approach for each model when it comes to development and implementation. You need to be confident new releases not only work, but work as intended and do not compound issues or create new ones. Ensuring you and your vendors have a robust process is critical to make sure your bank is protected here. The third step is to make sure you periodically assess the risk inherent in each model and in the aggregate. Is the model conceptually sound, do the results make sense and do they make sense in context of what you see or know? If you are going to rely on a model, you should make sure it is working properly and then periodically have it back-tested and reviewed to make sure it functions as you expect and over a longer period of time. Another thing to do is to make sure the person operating the model has the skills, training and proper controls around them. They should be able to demonstrate an understanding of what is happening in the model, what is important, what is not and where it is inaccurate. They should understand the key assumptions that drive results and each model's limitations. Saying results or models used are conservative does not make them so. Reports should be challenged if they create odd or unusual results. Finally, have a 3rd party come in and check results. This should not be designed as a gotcha' process, but rather as a way to make sure results can be relied upon. Here, reviewers should check models and modeler skills to make sure the bank has proper policies, controls, work processes, limitations and usage documented and in place. Assumption testing, completeness, accuracy and operational assessments are important to make sure the data from the model can be relied upon. No matter which model risk you are trying to manage, knowing these things should help.