The Model That Passed Validation and Nobody Owned
A mid-sized regional bank has just received its regulator's annual review letter. The internal audit report notes that the bank's credit-scoring model, used to approve small-business loans up to $250,000, was redeveloped eighteen months ago by an external vendor. Validation was performed once, at delivery, by a two-person team inside the risk function. Since then the model has been recalibrated twice by the same vendor, each time under a change request signed by the head of retail lending. The risk committee has not seen a validation report since the original delivery. The chief risk officer position has been vacant for five months; the deputy CFO is acting in the role while also chairing the credit committee. The regulator's letter asks the board to explain how model risk is governed and who is accountable. The board has asked you, as an external adviser, to identify the governance failures and recommend a structure that would survive the next review.
1. Identify the specific governance failures in this setup and explain why each one matters to the regulator, distinguishing between failures of structure and failures of process.
Read the worked answer
The structural failures are the ones a regulator will treat most seriously because they cannot be fixed by a memo.
Concentration of authority. The deputy CFO acts as CRO while chairing the credit committee. The CRO is supposed to be the second line challenging the first line's lending decisions; chairing the committee that approves credit policy puts the same person on both sides. The regulator's concern is not that this individual is dishonest but that challenge cannot be demonstrated, and independence is a matter of observable structure, not intent.
No accountable model owner. The vendor built and recalibrates the model, and the head of retail lending signs the change requests. That means the person with commercial incentive to keep approvals flowing controls model changes, and no independent function owns the model's fitness for purpose. Model risk frameworks require a named owner in the business plus independent validation; here the two roles are collapsed into the vendor and the revenue line.
Validation is a one-time event, not a control. Validation at delivery is a project deliverable. Two recalibrations have occurred since with no revalidation, so the bank cannot show the model still performs as intended on current data.
The risk committee is blind. No validation report in eighteen months means the committee cannot exercise oversight, and its minutes will show it approved lending growth without evidence about the model driving that growth.
The process failures are the change-control path (vendor-initiated recalibration signed only by the business), the absence of ongoing monitoring thresholds, and the lack of a model inventory with tiering that would have flagged this model as material. Structure first: separate the CRO and committee chair roles, appoint an accountable executive owner, and give validation a reporting line that does not run through lending. Then fix process: mandatory revalidation triggers, independent sign-off on vendor changes, and standing model-risk reporting to the committee.
2. The board asks whether it can simply ratify the vendor's two recalibrations retroactively and move on. Advise them, explaining what a defensible remediation would require and what risks retroactive ratification creates.
Read the worked answer
Retroactive ratification is legally possible but evidentially weak, and the board should understand why before agreeing.
What ratification does not cure: it does not establish that the recalibrated model was fit for purpose during the period it was in use. Loans were approved on those parameters. If the recalibration shifted approval thresholds, the bank may have booked exposures it would not otherwise have taken, and ratification cannot retroactively validate those decisions. It also does not restore the missing independent challenge, because the ratifying body never saw the analysis.
What a defensible remediation looks like:
- Reconstruct the record. Obtain the vendor's recalibration documentation, the change requests, and the performance data for the period. Document what changed and by how much.
- Independent validation now, scoped to the period. A validator outside the lending line should assess both current fitness and back-test performance over the eighteen months, so the board knows whether harm occurred.
- Impact assessment. Quantify the population of loans approved under the recalibrated parameters and test for adverse selection or deterioration. If the sample is small, say so; if it is large, the board needs a provisioning view.
- Conditional ratification. The board can accept the recalibrations as the current baseline while explicitly recording that they were not independently validated at the time, and attach conditions: revalidation within a set period, ongoing monitoring thresholds, and a requirement that future vendor changes receive independent sign-off before use.
- Remediate the control, not just the instance. Fix the change-control path so the next recalibration cannot follow the same route.
The risk of pure ratification is that the board's minutes become the regulator's evidence that the board knew about an unvalidated model and chose to paper over it. Conditional ratification with a documented remediation plan is defensible; unconditional ratification is not.