The Credit Model That Passed Validation and Failed Fairness

Strongest part: disparate-impact doctrine generally permits practices that are necessary to a legitimate business purpose and that cannot be achieved with a less discriminatory alternative. Credit risk prediction is a legitimate purpose, and the lender has validation evidence that the model is accurate. If the lender can show that the 22-point gap reflects genuine risk differences that a less discriminatory model cannot capture without material loss of predictive power, that is a real argument.

Weakest parts, in order of severity:

1. Proxies undercut the 'we don't use protected attributes' claim. ZIP code, device type, and transaction-category spend are classic proxy variables. The defense is not 'we excluded the protected field'; it is 'our feature set does not encode protected status in a way that produces unjustified disparity.' The lender has not shown that.
2. Business necessity requires a less-discriminatory-alternative analysis the lender has not done. The defensible posture is to test whether a model without the proxy features, or with constraints, retains most of its discrimination. Until that test exists, 'business necessity' is an assertion, not a finding.
3. The 22-point gap was surfaced externally, not internally. That is a monitoring failure independent of the legal merits, and regulators weigh governance failures heavily.

The lender should not concede liability, but it also cannot defend a position it has not evidenced. The immediate need is analysis, not retraining or waiting.

The three impulses are not mutually exclusive, but doing them in the wrong order creates new exposure.

1. Before any public statement: establish the facts internally (days, not weeks). Recompute the approval-rate gap on the lender's own data, confirm the journalist's methodology, and determine whether the gap is explained by risk factors or by proxy features. A statement issued before this is known will either overclaim ('our model is fair') or concede prematurely. Both are worse than a short, accurate holding statement: acknowledge the inquiry, state that the lender is examining the disparity, and commit to a timeline.

2. Run the less-discriminatory-alternative analysis before retraining. Immediate retraining is intuitive but risky: a hastily retrained model may perform worse, may still show the gap, and will look like an admission that the prior model was unlawful. The disciplined step is a shadow analysis - retrain without proxy features and with fairness constraints, measure the accuracy/fairness trade-off, and let the evidence drive the decision. This takes weeks, not months, and it is also the evidence the regulator will ask for.

3. Do not wait for the inquiry outcome to act. Waiting cedes control of the narrative and the remediation timeline to the regulator. The lender can act on its own findings while cooperating fully.

4. Communicate to the CEO that the public statement should describe process and commitment, not conclusions. 'We are examining this, here is our governance, here is our timeline' is defensible at any outcome; 'our model is fair' is not.

Sequencing principle: facts → options → decision → disclosure, with a holding statement bridging the gap.

The gap was detectable from the lender's own published statistics, which means the failure was in monitoring design, not data availability.

Changes:

• Outcome monitoring on protected-group approval rates and error rates, run on a fixed cadence (monthly for a product this size), with pre-agreed thresholds that trigger review. Monitoring only at validation time is the defect.
• A proxy-feature review as a standing gate. Any feature correlated with protected status above a defined threshold requires a documented justification and a less-discriminatory-alternative test before deployment.
• An independent challenge function with authority to block deployment and the standing to escalate past the business line. The current setup let Credit own both the model and its validation.
• A model inventory entry that records the fairness testing performed, the trade-offs accepted, and the named accountable executive.
• A pre-agreed disclosure protocol so a public-statistics analysis does not arrive as a surprise.

Evidence the controls work:

• Disparity metrics tracked over time with a documented response when thresholds are crossed - not just the existence of a dashboard.
• A log of less-discriminatory-alternative tests performed, including cases where the original model was retained and why.
• At least one documented instance of the challenge function changing a decision; a control that has never bitten is probably not functioning.
• Reduced time from anomaly detection to documented remediation.

Avoid the trap of treating 'we hired a fairness team' as evidence. The test is whether a disparity would now be caught before a journalist catches it.