Model governance

Institutions should ensure that the validation of IRRBB measurement methods — which should be reviewed and validated independently of their development — and the assessment of corresponding model risk are included in a formal policy process that should be reviewed and approved by the management body or its delegates. The policy should be integrated within the governance processes for model risk management and should specify:

• (a) the management roles and designate who is responsible for the development, validation, documentation, implementation and use of models; and
• (b) the model oversight responsibilities as well as policies including the development of initial and ongoing validation procedures, evaluation of results, approval, version control, exception, escalation, modification and decommission processes.

The validation framework should include the following five core elements:

• (a) evaluation of conceptual and methodological soundness, including developmental evidence;
• (b) ongoing model monitoring, including process verification and benchmarking;
• (c) outcomes analysis, including back-testing of key internal parameters (e.g., stability of deposits, loan prepayment rates, early redemptions of deposits, pricing of instruments);
• (d) thorough assessment of any expert opinions and judgements used in internal models; and
• (e) Validation of diversification assumptions.

In addressing the expected initial and ongoing validation activities, the policy should establish a hierarchical process for determining model risk soundness based on both quantitative and qualitative dimensions such as size, impact, past performance and staff expertise with the modelling technique employed.

Model risk management for IRRBB measures should follow a holistic approach that begins with motivation, development and implementation by model owners and users. Prior to receiving internal approval for usage, the process for determining model inputs, assumptions, modelling methodologies and outputs should be reviewed and validated independently of the development of IRRBB models.

The review and validation results and any recommendations on model usage should be presented to and approved by the management body or its delegates. Upon approval, the model should be subject to ongoing review, process verification and validation at a frequency that is consistent with the level of model risk determined and approved by the institution.

The ongoing review process should establish a set of exception trigger events that obligate the model reviewers to notify the management body or its delegates in a timely fashion, in order to determine corrective actions and restrictions on model usage. Clear version control authorisations should be designated, where appropriate, to model owners.

On the basis of observations and new information gained over time, an approved model may be modified or withdrawn. Institutions should articulate policies for model transition, including change and version control authorisations and documentation.

Institutions may rely on third-party IRRBB models to manage and control IRRBB, provided that these models are adequately customised to properly reflect the specific characteristics of the institution in question. Institutions are expected to fully understand the underlying analytics, assumptions and methodologies of the third-party models and to ensure that they are adequately integrated into the institutions’ overall risk management systems and processes. Where third parties provide input for market data, behavioural assumptions or model settings, the institution should have a process in place to determine if those inputs are reasonable for its business and the risk characteristics of its activities. Institutions should ensure there is adequate documentation of their use of third-party models, including any specific customisation.

Model inputs or assumptions, whether stemming from internal model processes or from third parties, should be included in the validation process. The institution should document and explain model specification choices as part of the validation process.