For years, model risk management leaders have been challenged to manage growing model inventories with flat budgets while often being perceived as a bottleneck to innovation. The new SR 26-2 guidance from federal regulators directly addresses this reality. Rather than inventing new principles, SR 26-2 largely codifies and formalizes the best practices that mature MRM functions have begun adopting over the last decade, accelerating the strategic evolution of the MRM function. For banks, this is a pivotal moment. Firms that embrace this transformation will build leaner and risk-driven MRM functions that are proportional to the firm’s model inventory.
From Standardization to Proportionality
The revised guidance repeatedly emphasizes that a practice that is appropriate for one banking organization may be inappropriate for another institution with a different risk profile, model usage or level of complexity.
This is an important distinction.
SR 26-2 does not tell banks to stop validating models, reduce governance or abandon model inventories. Instead, it asks institutions to think more carefully about how much MRM is appropriate for a particular risk.
For example, a highly material model used to make significant credit, capital or risk-management decisions may warrant extensive independent validation, frequent monitoring and detailed documentation.
A lower-risk model with limited exposure and a relatively simple methodology may not warrant the same level of resources.
The result is a shift from a “one-size-fits-all” model-risk program toward a more explicitly risk-tiered program.
The $30 Billion Threshold
One of the most discussed changes is the revised guidance’s treatment of institutions with $30 billion or less in assets.
SR 26-2 states that the guidance is expected to be most relevant to banking organizations with more than $30 billion in total assets. For organizations at or below $30 billion, the agencies generally expect model-risk practices appropriate to the institution’s size and risk profile.
However, it would be inaccurate to describe this as a blanket exemption.
The guidance says it may also be relevant to smaller institutions that have significant model-risk exposure because of the prevalence or complexity of their models or because they engage in activities outside traditional community banking.
That distinction is particularly important for executives interpreting the guidance.
The practical question for a smaller bank is therefore not simply:
“Are we below $30 billion?”
It is:
“What is the size and complexity of our actual model-risk exposure?”
A smaller institution with a relatively simple model environment may reasonably have a substantially lighter MRM framework than a large institution.
A smaller institution with numerous sophisticated models, complex activities or significant reliance on models may still need robust controls.
Definition of a “Model”
Under the revised guidance, a model is a complex quantitative method, system or approach that applies statistical, economic or financial theories to process input data into quantitative estimates.
The guidance specifically excludes:
- simple arithmetic calculations, including spreadsheet calculations;
- deterministic rule-based processes; and
- software without underlying statistical, economic or financial theories.
This could have significant implications for model inventories.
Under the SR 11-7 framework, many institutions adopted conservative inventory practices, capturing a wide range of quantitative tools because broad inclusion reduced the risk of inadvertently omitting something important.
SR 26-2 gives institutions a clearer basis for distinguishing an actual model from a calculation, deterministic process or other technology.
The Concept of Materiality
Effective challenge has not gone away.
The revised guidance continues to emphasize objective, knowledgeable challenge throughout the model lifecycle.
That includes questioning:
- assumptions;
- methodology;
- data;
- implementation;
- limitations;
- performance; and
- use.
The lesson for model-risk leaders is that greater flexibility in the frequency or scope of validation does not eliminate the need for credible independent challenge.
If anything, the greater the institution’s discretion, the more important it becomes to have people who can challenge management’s decisions about model materiality and MRM intensity.