ch1 Model Governance

What is a "model" as defined in the Model Risk Governance Framework?

A quantitative method that applies mathematical and/or logical rules, including expert judgment, to process input data into a quantitative estimate.

What are the three core elements involved in model processing flow?

Input Data (information and assumptions), Rules (mathematical/logical rules and expert judgment), and Estimate (quantitative output).

What is the primary objective of the Model Risk Governance Framework?

To serve as a governance framework and provide guidelines for developing, implementing, validating, and monitoring credit risk models across their life cycle.

How is a "credit risk model" defined under the framework?

A statistical tool applied to determine the probability of debt repayment from a customer using statistical, economic, financial, or mathematical theories and assumptions.

What are the three key functional components of a credit risk model?

Information Input (data entering), Processing (transforming inputs into estimates), and Reporting (translating estimates into business information).

How is "model risk" defined?

The risk of a significant difference between model output values and reality, leading to potential adverse consequences from decisions based on incorrect or misused outputs.

What is the core focus of Model Risk Governance?

Defining roles and responsibilities across model risk management, emphasizing independence, conflict of interest management, Risk Management Committee oversight, and internal audit.

What is the minimum historical data period required for developing credit risk models?

At least 5 years of historical data.

When internal historical data is insufficient for credit risk modeling, what data source may be used as an alternative?

Comparable proxy data or external data exhibiting similar behavior and risk profiles.

Which structural governance framework is followed for model risk governance?

The 'three lines of defense' governance model.

What are the primary accountabilities of Business Lines in model governance?

Agreeing on business conditions prior to development, ensuring proper operational implementation, and providing ongoing feedback on model usage.

What role does the Executive Committee (ExCo) perform regarding model risk governance?

Advising and endorsing governance policies, approving model usage, approving aggregate model risk monitoring results, and reviewing framework effectiveness.

What are the main duties of the Risk Management Committee (RMC) in model governance?

Advising on governance for BOD approval, ensuring executive compliance, reviewing performance reports, recommending policy reviews, and fostering model risk culture.

What are the core duties of the Model Developer?

Developing models internally, testing for accuracy, documenting parameters/methodology, identifying risks, conducting regular quarterly monitoring, and supporting validators.

Which quantitative reports and metrics are recommended for quarterly model monitoring by the Model Developer?

P-Value, Adjusted R^2, Mean Square Error (MSE), Mean Absolute Percentage Error (MAPE), and characteristic analysis reports.

What key responsibilities belong to the Risk Department regarding models?

Ensuring independent validation, challenging developer risk assessments, updating the model registry, monitoring risk appetite adherence, and reporting breaches.

What is the specific responsibility of the Compliance Department in model risk governance?

Ensuring that the Model Risk Governance Policy and institutional implementation adhere to regulatory requirements.

What is the function of Audit Functions (Internal and External) as the third line of defense?

Independently reviewing the framework, assessing governance and control adherence, evaluating process design, and performing compliance checks.

Who approves new model developments or redevelopments before implementation?

Approved by ExCo, with acknowledgement from RMC.

Who holds approval authority for annual model recalibrations?

Approved by ExCo, with acknowledgement from RMC.

What deliverable is required from the Model Developer during the Model Development process stage?

A technical model development document complete with an impact assessment.

What deliverable must be produced during pre-implementation model validation?

A pre-implementation model validation report produced by the independent validator.

What action is required of the Model Developer regarding the Model Inventory?

Maintain an updated inventory of all models (in use, under development, or decommissioned) and certify its completeness and accuracy.

What security control must be maintained over model environments?

Models must reside in controlled environments to prevent unauthorized or unintended changes and ensure compliance with IT security policy.

Who must approve sharing confidential model attributes or weights outside the Risk Management Department?

The Head of the Risk Department (or delegate), or the Model Developer/Owner when sharing with implementation units such as IT or Finance.

Why is integrating a Model Risk Appetite Statement (RAS) into the overall institutional RAS necessary?

It establishes boundaries for model risk taking, provides senior management visibility, and aligns model risk metrics with strategic business planning.

How is a "Green" (Low Risk) model risk grading described?

The model performs as expected (or with slight deviations) and has no significant findings from regular reviews, monitoring, audit, or validation.

What circumstances cause a model to receive a "Yellow" (Medium Risk) grading?

Late independent validation, a serious failure in a regular review, or notable performance deterioration across several reviews.

What is the recommended remediation timeframe for a "Yellow" rated credit risk model?

Within a relatively short time frame, recommended to be within 3 months, via an independent validation process.

How is a "Red" (High Risk) model risk grading defined?

Model performance is significantly below expectation, demonstrating significant failure or severe deterioration.

What standard course of action and timeline are mandated for a "Red" rated model?

It must be recalibrated or rebuilt within a fixed timeframe (recommended within 6 months), or its use must be discontinued.

What key information should be documented in the Model Term of Reference (ToR) stage?

Business purpose, intended use, design decisions, development approach, timelines, and budget.

What requirement applies to model testing during the Model Life Cycle?

Rigorous testing must be employed prior to deploying a model or undergoing a significant change, with all testing results documented.

What must be included in comprehensive Model Documentation?

Model theory, development process, business and technical requirements, methodology assumptions, and associated risks.

For vendor-provided or externally developed models, what specific documentation must the institution retain?

Documentation covering the research and development of the vendor models.

What model elements must undergo independent validation prior to implementation?

All model components, including model inputs, assumptions, processing, outputs, and reporting.

What are the two regular elements of post-implementation periodic model review?

Quarterly performance monitoring (stability and characteristic analysis) and annual independent post-implementation validation.

How is "Model Redevelopment" defined?

Building a new model or replacing an existing model where the model structure is fundamentally changed.

How is "Model Recalibration" defined?

Changing model parameters (such as PD, LGD, EAD) per segment or rating class without altering the underlying model structure.

What governance process is required for material post-implementation changes to model structure?

They must be fully documented, approved by the appropriate authority, and subjected to independent validation.

What are the five structural dimensions evaluated during Model Validation?

1. Methodology and Theory, 2. Data, 3. Output Validation, 4. Model Implementation and Use, and 5. Model Governance.

What elements are validated under the "Methodology and Theory" dimension?

Choice of assumptions and variables, theoretical foundation, relevance to purpose, and the Model Choice Document.

What checks are conducted under the "Data" validation dimension?

Data accuracy, completeness, size and relevance of development sample, processing procedures, and quality controls.

Which techniques are evaluated under the "Output Validation" dimension?

Back-testing, sensitivity analysis, and stability analysis.

What aspects are checked under the "Model Implementation and Use" dimension?

Business requirements alignment, User Acceptance Testing (UAT) process review, model operational controls, and reporting and decision-taking processes.

What key governance aspects are validated under the "Model Governance" dimension?

Validator independence, clarity of roles and responsibilities, approval processes, and overall model risk management processes.

What is the Model Risk Registry?

A designated central registry preserving information on all models developed, managed, active, or decommissioned within the institution.

What four core categories of record history does the Model Risk Registry preserve?

1. All developed/managed models, 2. Validation historical records, 3. Quality and risk grading history, and 4. Traceability of actions and performance.

What is the primary purpose of maintaining a log in the Model Risk Registry?

To enable authorized independent validators to fully trace back the complete history of actions regarding model development, validation, and performance.

What step must follow if periodic post-implementation model validation yields negative outcomes?

The model risk grading must be updated, triggering formal communication, escalation, and timely implementation of corrective actions.