The value of a robust model risk management framework

The FDIC’s annual safety and soundness examination can be an uneasy and disruptive moment for any financial institution, but for one regional bank with $15 billion in total assets, the anxiety was heightened—and, as it turned out, justified.

To assess the bank’s safety and soundness, the agency’s supervisory team conducted a full-scope, on-site examination of the bank’s performance based on its financial condition, operational controls, risk management practices, and compliance with banking regulations.

The bank had only recently hired an employee to help oversee model risk management. That individual planned to further mature the bank’s model risk function to ensure that: 1) its models predicted results based on inputs that were developed and used appropriately, and 2) its outputs were accurate and reliable. Since models play a significant role in a modern financial institution’s decision-making processes, model risk has emerged as a key concern for financial institutions and industry regulators.

When the examiners arrived, this new resource hadn’t yet had a chance to delve into the details of the institution’s existing model risk program. As a result, the program fell short of regulatory expectations during the examination. After the FDIC examiners concluded their examination, they issued multiple Matters Requiring Attention (MRAs) and Matters Requiring Immediate Attention (MRIAs) around maturing the model risk function, framework, and execution of the framework, and they set a tight timeline to remediate the issues.

The value of model risk management and the consequences of failure

The examination came at a decidedly inopportune moment while the bank was updating its model risk program. All financial institutions use models to define strategy and manage risk, for example:

• Credit underwriting models
• Anti-money laundering models
• Capital models
• Asset liability and management and liquidity models
• Allowance for credit losses models

Financial institutions use these models to make critical operational and strategic decisions, which is why regulators focus so intensely on them. Examiners expect robust documentation, understanding, and testing of model performance. Poor examination performance can lead to MRAs, MRIAs, and increasing examination frequency and depth.

And while the CAMELS ratings are confidential, enforcement actions may be made public. The speed of information on social media and the ease in which customers can perform electronic transfers places increasing pressure on examination results.

The clock is ticking

With a tight deadline for remediation, the bank had to scramble to address its shortcomings. That meant rapidly redeploying resources to fix those issues in a hurry. This opened the possibility that the bank could make decisions in haste, decisions it would not make in the normal course of developing a framework. This kind of situational pressure can lead to choosing a sub-optimal solution just because it could be implemented quickly or an overbuilding of the framework rather than optimization. Most importantly, it takes resources away from executing the model risk program and managing risk to put out the fire.

This wasn’t a situation the bank wanted to face on its own. It recognized that its risk model management program hadn’t reached the appropriate level of maturity, so it engaged RSM to help it build out the program by fleshing out all its components, including framework, policy, and procedures. The bank’s leaders were looking for tools, such as templates, to maintain the framework, as well as a trusted advisor to provide ongoing subject matter support once the framework was implemented.

Working with RSM also provided consistent institutional knowledge impervious to staff turnaround, as well as guidance on further maturation of the program as the organization grew. These elements provided the rightsizing needed to prevent costly over-building or risky under-building of the framework.

Regulatory compliance goes beyond

Passing a regulatory examination is a high-five moment, but it’s only part of the value of a robust model risk management framework. In the end, this organization discovered how a disciplined approach to model risk management increases the value of its highly utilized models and improves the decisions they affect. Strong risk management benefits everyone. It helps the organization improve efficiency, make better decisions and achieve strategic objectives.