The Capital Buffer That Depended on a Model
A bank reports a common equity tier 1 ratio of 10.8%, just above its 10.5% internal target. The ratio depends on risk-weighted assets produced by an internal model for commercial real estate. A model validation unit reports that the probability-of-default estimates for one CRE segment have been understated because the model uses a five-year lookback that excludes the last downturn. Recalculating that segment with a longer window would raise risk-weighted assets by an estimated 6%, which would push the CET1 ratio to roughly 10.2%. Management argues the model is approved by regulators and that the validation finding is conservative. The CFO asks the internal auditor whether the ratio can still be reported as is.
1. What is the auditor's role here, and what should the auditor say about reporting the ratio?
Read the worked answer
The auditor is not the model owner and should not opine on the correct PD estimate. The auditor's role is to assess whether the model risk management process functioned: was the validation independent, was the finding escalated, was there a documented remediation plan, and did governance approve continued use of the model with a known limitation? The auditor should not tell the CFO what ratio to report; that is management's and the CFO's judgment, subject to disclosure and regulatory requirements.
The auditor should say: the ratio as computed is arithmetically correct under the approved model, but the bank now has information that the model may understate risk. Reporting the ratio without disclosing the validation finding and its estimated impact could be misleading. The auditor should recommend that management (1) document the finding and its estimated 6% RWA impact, (2) present it to the asset-liability committee and board risk committee, (3) determine whether disclosure or regulatory notification is required, and (4) set a remediation timeline. The auditor should also test whether the validation unit had adequate independence and resources.
2. How would you test whether the capital planning process is sound beyond this single model?
Read the worked answer
Test the full chain. Governance: does the board approve the capital plan and the risk appetite, and does it receive model-limitation information? Model inventory: is the CRE model in the inventory, with an owner, validation date, and tier rating? Validation: was the validation independent of the model developers, and did it have authority to escalate? Assumptions: are lookback windows, downturn calibration, and segment definitions documented and challenged? Sensitivity: does management run stress scenarios, and did anyone model the effect of a longer lookback before the validator did? Use test: is the model actually used in decisions, or is it a compliance artifact? Change control: who approved the model, and when is it revalidated?
The auditor should also check whether the same lookback limitation affects other segments or the stress-testing models, and whether the internal target of 10.5% has a buffer for model uncertainty. A sound conclusion would note that the process identified the issue (a strength) but that escalation and disclosure were incomplete (a weakness), and would recommend a board-level discussion of model risk in the capital plan.