Internal Audit
What is the role of Internal Audit?
Internal audit has an important role in ensuring that model governance and validation are conducted properly and effectively challenged. Notably, SR11-07 and Supervisory Expectations for CCAR emphasize internal audit and its overall assessment of the firm’s model risk management framework, including whether the framework is comprehensive, rigorous, and effective.1
Per the model risk guidance, internal audit:
“should evaluate the objectivity, competence, and organizational standing of the key validation participants, with the ultimate goal of ascertaining whether those participants have the right incentives to discover and report deficiencies… [It] should review validation activities conducted by internal and external parties with the same rigor to see if those activities are being conducted in accordance with this guidance.”
What do we offer?
We are here to help any internal audit department to fulfill regulatory and fiduciary responsibilities related to
- Model Risk Management
- Stress Testing
- General Risk Management
Our experts have deep experience in every type of risk and almost every modeling technique. We are not auditors. We are successful developers and validators who know the guidance, but, more importantly, know the requirements for success.
We competently assess all functions, including model governance – as governance without appropriate, technically-inclined validation is not governance at all.
Turning Expectations Into Reality
Guidance and supervisory expectations require the same level of sophistication as the other areas, but unfortunately, many firms cannot hire sufficient numbers of or sufficiently qualified quantitative staff for development and validation, let alone internal audit.
Within firms as senior model risk executives and as regulators, we have frequently and successfully performed assessments and gap analyses comparing guidance ⇄ policies, policies ⇄ procedures, and procedures ⇄ actions.
- For CCAR, this is Principle 6 in Capital Planning at Large Bank Holding Companies: Supervisory Expectations and Range of Current Practice: “The BHC has robust internal controls governing capital adequacy process components, including policies and procedures; change control; model validation and independent review; comprehensive documentation; and review by internal audit.”