Governance answers the question “How do you turn regulatory guidance into consistent, repeatable actions that comply with said guidance?”
For well-written guidance, like SR 11-07, consistency with it can get the firm close to good management and even best practices.
Typically, one provides evidence of compliance by showing that the firm’s policies closely reflect the guidance–with any deviations identified and well-documented–that procedures fully support the policies and that enterprise-wide, actions and practices follow procedures.
While firms may have one model risk management policy, larger firms frequently have separate policies for development and validation. Because the tasks are so distinct, all firms should have separate development, governance, and validation procedures. In fact, large firms may have separate procedures for each type of model development. We have written and reviewed (and implemented) all types of procedures.
Three Common Governance Mistakes
Typically firms make one of these three mistakes –
1. The policies and procedures are
too broad and over-simplified.
2. The policies and procedures are
way too detailed and over-complicated.
3. Failure to execute the policies
and procedures that are necessary.
First and Second are the extremes of the policies and procedures spectrum. Either case makes it difficult to show that actions comply with the guidance. First, because too much is left to interpretation, which leads to confusion, and, second, because there is too little consistency, which leads to confusion, too.
Frequently, the former comes off as simplistic whereas the latter appears academic, out-of-touch, bureaucratic or irrelevant. (Kind of like counting the number of model risk angels that can fit on the head of a pin.) Policies and procedures should satisfy Goldilocks: neither too big or too small, too hard or too soft.
The third type of governance mistake is the failure to execute (what may otherwise be) sound policies and procedures. Frequently these failures exist in the governance function itself, particularly in validation. The causes of this type of failure include: (i) a lack of commitment by executive management; (ii) the unwillingness of governance and validation managers to perform their responsibilities per the governance framework; and (iii) the inability of the validation staff to perform credible inspections.
Our Advantage
We can write each component of an overall governance framework and help solve all types of problems through well-designed communication, training, and staffing services. While building and implementing an appropriate model risk governance framework may seem expensive, it is important to realize that it is a long-term investment that will lead to better strategic and operating decisions through both more effective and efficient model development: better, more adaptable models at lower costs.