Model risk is defined by the Office of the Comptroller of the Currency (OCC) as “the potential for adverse consequences from decisions based on incorrect or misused model outputs and reports.” That being said, any risk model that is developed needs to be maintained to ensure that the risk model is adequately supporting the financial institution. Per the OCC’s supervisory guidance provided in SR Letter 11-7, Supervisory Guidance on Model Risk Management, model risk occurs primarily for two reasons: the model may have fundamental errors and may produce inaccurate outputs when viewed against the design objective and intended business uses; or the model may be used incorrectly or inappropriately.
It is because of these two primary factors that scheduled periodic reviews of risk models need to happen. Most thoughts involving model risk management seem to revolve around the management of automated systems. This tuning of automated systems often consists of an evaluation of data inputs, result outputs, and how those data sets correlate to expectations, exclusions and exceptions. The results of tuning an automated system do not always mean less outputs, but better yet, a better understanding of inherent risk should evolve over time and influence a risk model.
However, supervisory guidance on model risk management doesn’t just include the periodic tuning of automated systems, but also implies reviews of manual processes and report validation risk models, as those are not exempted from validation. Ensuring that these manual processes and reports are adequate and meet expectations is vital to the health of a financial institution’s compliance program. These model risk management techniques become their own set of risk models, which, if you follow correctly, need their own systems to manage the risk.
In our opinion, like all things involving risk, there is no one way to do anything and theories abound. As long as there is forward momentum, a competent effort in good faith and a willingness to be compliant, positive results will be realized.