Model Risk Auditing
Helping internal audit departments fulfill regulatory and fiduciary responsibilities for model risk management, stress testing, and general risk management.
What is the role of Internal Audit for Model Risk?
Internal audit has an important role in ensuring that model governance and validation are conducted properly and effectively challenged. Notably, SR26-2 and Supervisory Expectations for CCAR emphasize internal audit and its overall assessment of the firm’s model risk management framework, including whether the framework is rigorous and effective.1
Per the new model risk guidance, SR 26-2,
“Sound governance practices delineate the individual(s) responsible for key activities throughout the model lifecycle, from development through validation and ongoing monitoring. In cases where internal audit is part of the banking organization’s model risk management practices, internal audit would generally not duplicate model risk management activities such as model development or validation. Instead, internal audit’s role is generally to evaluate whether the model risk management practices are rigorous and effective and whether related policies are implemented accordingly.”
What do we offer?
We are here to help any internal audit department to fulfill regulatory and fiduciary responsibilities related to
- Model Risk Management
- Stress Testing
- General Risk Management
Our experts have deep experience in every type of risk and almost every modeling technique. We are not auditors. We are successful developers and validators who know the guidance, but, more importantly, know the requirements for success.
We competently assess all functions, including model governance – as governance without appropriate, technically-inclined validation is not governance at all.
Turning Expectations Into Reality
Guidance and supervisory expectations require the same level of sophistication as the other areas, but unfortunately, many firms cannot hire sufficient numbers of or sufficiently qualified quantitative staff for development and validation, let alone internal audit.
As senior model risk executives and as a regulator, we frequently and successfully performed assessments and gap analyses by comparing guidance ⇄ policies, policies ⇄ procedures, and procedures ⇄ actions. We’ve performed similar services here.
- For CCAR, this is Principle 6 in Capital Planning at Large Bank Holding Companies: Supervisory Expectations and Range of Current Practice: “The BHC has robust internal controls governing capital adequacy process components, including policies and procedures; change control; model validation and independent review; comprehensive documentation; and review by internal audit.”