SR 11-7 establishes a comprehensive framework for identifying, measuring, and controlling model risk in banking organizations. Implementing its guidance ensures that quantitative models—ranging from credit-loss algorithms to stress-testing tools—are accurate, reliable, and used appropriately, thereby safeguarding financial stability and regulatory compliance.
1. Background and Scope
SR 11-7, issued by the Federal Reserve Board and OCC on April 4, 2011, addresses the adverse consequences of decisions based on flawed or misused models. It applies to all banking organizations under Federal Reserve supervision, scaled according to each institution’s size, complexity, and model risk exposure.
2. What is a Model and Model Risk ?
- Model: Any quantitative method, system, or approach applying statistical, economic, financial, or mathematical theories, techniques, or assumptions to process input data into quantitative estimates.
- Model Risk: The potential for adverse outcomes—including financial loss or poor strategic decisions—arising from:
- Fundamental Errors: Conceptual, design, implementation, or use flaws.
- Misuse: Applying a valid model outside its intended purpose or without understanding its limitations.
3. Three Pillars of Effective Model Risk Management
SR 11-7 organizes model risk management into three interrelated components:
3.1 Model Development, Implementation, and Use
Banks must ensure that models are designed, built, and deployed under rigorous standards:
- Model Inventory: Maintain a centralized registry of all models, including metadata on purpose, inputs, owners, and dependencies.
- Development Standards: Document design choices, data sources, assumptions, and intended use cases. Employ version control and code reviews.
- Deployment Controls: Implement change-management protocols, secure code repositories, and access controls to prevent unauthorized alterations.
3.2 Model Validation
An independent validation function must challenge models throughout their lifecycle:
- Validation Plan: Define validation scope, procedures, and acceptance criteria.
- Testing and Benchmarking: Perform back-testing against historical data, stress-testing under extreme scenarios, and sensitivity analysis.
- Ongoing Monitoring: Track performance metrics (e.g., prediction error, calibration drift) and validate model outputs at regular intervals—at least annually or upon material change.
- Documentation: Produce validation reports detailing findings, remediation actions, and validation approval.
3.3 Governance, Policies, and Controls
Robust governance ensures accountability and oversight:
- Board and Senior Management Oversight: Approve and periodically review the model risk management policy. Receive aggregate model risk reports.
- Model Risk Policy: Define risk appetite, roles, responsibilities, and escalation protocols.
- Effective Challenge: Establish an independent review committee to question assumptions, methodologies, and results.
- Audit and Compliance: Internal audit must assess the adequacy and effectiveness of the MRM framework, with findings reported to senior management and the board.
4. Detailed Implementation Steps
5. Key Considerations and Best Practices
- Proportionality: Tailor the depth of validation and governance to model complexity and materiality.
- Effective Documentation: Ensure all phases—development, validation, deployment—are fully documented, enabling transparency and reproducibility.
- Technology Enablement: Leverage workflow automation for inventory management, version control, and monitoring to reduce manual errors and improve efficiency.
- Cross-Functional Collaboration: Promote ongoing dialogue among model developers, users, validators, risk managers, and auditors for holistic oversight.
- Training and Culture: Invest in training programs to build quantitative literacy across business lines and foster a risk-aware culture.
6. Conclusion
Implementing SR 11-7’s guidance on Model Risk Management is essential for banking organizations relying on quantitative models. A structured approach—grounded in comprehensive policies, independent validation, and strong governance—mitigates model risk, enhances decision-making, and ensures compliance with supervisory expectations.
References
SR 11-7: Guidance on Model Risk Management
Supervisory Guidance on Model Risk Management (Attachment)