The Model That Passed Validation
A bank uses an internal model to estimate credit losses on a $2.3 billion small-business portfolio. The model was validated 18 months ago and approved by the model risk committee. Since then, the portfolio has grown 40%, the bank has entered two new regions, and delinquency in the new regions is running at 2.4 times the model's prediction. The model owner says the variance is "early-stage noise" and has not submitted a change request. The validation team reports to the same executive as the model owner, and the last three validation reports were signed off by the same individual who approved the original model. The bank's model risk policy requires annual revalidation and sets a 15% variance threshold for escalation. The CRO has asked for your view before the next board risk committee.
1. Assess the model risk governance failures and the significance of the variance.
Read the worked answer
Threshold breach. The policy sets a 15% variance trigger; delinquency at 2.4 times prediction is far beyond it. The model owner's "noise" characterization is not supported by any analysis in the file. The obligation to escalate is triggered by the policy, not by the owner's judgement.
Changed circumstances. A 40% portfolio increase and entry into two new regions are material changes to the model's population. A model validated on the prior book may not be fit for purpose. Continuing to use it without revalidation risks understating losses and misinforming capital and pricing decisions.
Independence failure. The validator reports to the same executive as the model owner, and the same individual signed off both the original approval and the last three validations. That is a direct conflict: validation must be independent of model development and ownership, and periodic rotation of sign-off is a basic safeguard.
Overdue revalidation. The policy requires annual revalidation; at 18 months the model is out of date regardless of performance.
Reporting. The board risk committee has been receiving reports that do not surface these issues, which is itself a governance failure.
2. What should the CRO recommend to the board risk committee?
Read the worked answer
Immediate. Escalate the variance formally under the policy, document the owner's non-escalation as a breach, and apply a conservative overlay or adjustment to loss estimates pending revalidation. Suspend reliance on the model for capital or pricing decisions in the new regions, or apply a documented expert adjustment.
Revalidation. Commission an independent revalidation covering the expanded portfolio and new regions, with a defined scope and deadline. Require a change request from the model owner.
Governance fixes.
- Move validation reporting to the CRO or a separate function with no shared line to model owners.
- Require that the individual approving a model does not also sign its subsequent validations, and rotate sign-off.
- Add automatic escalation triggers so threshold breaches bypass owner discretion.
- Require board reporting on model performance versus prediction, overdue validations, and open findings.
Accountability. Refer the non-escalation and the independence breach to the appropriate governance forum for individual accountability review.
Board message. Be direct: the model is out of date, the variance is material, and the control environment around it has failed in three ways. Present a dated remediation plan with named owners.