The value of a robust model risk management framework

CASE STUDY | July 21, 2023

Authored by RSM US LLP

The FDIC’s annual safety and soundness examination can be an uneasy and disruptive moment for any financial institution, but for one regional bank with $15 billion in total assets, the anxiety was heightened—and, as it turned out, justified.

To assess the bank’s safety and soundness, the agency’s supervisory team conducted a full-scope, on-site examination of the bank’s performance based on its financial condition, operational controls, risk management practices and compliance with banking regulations.

The bank had only recently hired an employee to help oversee model risk management. That individual planned to further mature the bank’s model risk function to ensure that: 1) its models predicted results based on inputs that were developed and used appropriately, and 2) its outputs were accurate and reliable. Since models play a significant role in a modern financial institution’s decision-making processes, model risk has emerged as a key concern for financial institutions and industry regulators.

When the examiners arrived, this new resource hadn’t yet had a chance to delve into the details of the institution’s existing model risk program. As a result, the program fell short of regulatory expectations during the examination. After the FDIC examiners concluded their examination, they issued multiple Matters Requiring Attention (MRAs) and Matters Requiring Immediate Attention (MRIAs) around maturing the model risk function, framework, and execution of the framework, and they set a tight timeline to remediate the issues.

The value of model risk management and the consequences of failure

The examination came at a decidedly inopportune moment while the bank was updating its model risk program. All financial institutions use models to define strategy and manage risk, for example:

• Credit underwriting models
• Anti-money laundering models
• Capital models
• Asset liability and management and liquidity models
• Allowance for credit losses models

Financial institutions use these models to make critical operational and strategic decisions, which is why regulators focus so intensely on them. Examiners expect robust documentation, understanding, and testing of model performance. Poor examination performance can lead to MRAs, MRIAs, and increasing examination frequency and depth.

And while the CAMELS ratings are confidential, enforcement actions may be made public. The speed of information on social media and the ease in which customers can perform electronic transfers places increasing pressure on examination results.

The clock is ticking

With a tight deadline for remediation, the bank had to scramble to address its shortcomings. That meant rapidly redeploying resources to fix those issues in a hurry. This opened the possibility that the bank could make decisions in haste, decisions it would not make in the normal course of developing a framework. This kind of situational pressure can lead to choosing a sub-optimal solution just because it could be implemented quickly or an overbuilding of the framework rather than optimization. Most importantly, it takes resources away from executing the model risk program and managing risk to put out the fire.

This wasn’t a situation the bank wanted to face on its own. It recognized that its risk model management program hadn’t reached the appropriate level of maturity, so it engaged RSM to help it build out the program by fleshing out all its components, including framework, policy, and procedures. The bank’s leaders were looking for tools, such as templates, to maintain the framework, as well as a trusted advisor to provide ongoing subject matter support once the framework was implemented.

Working with RSM also provided consistent institutional knowledge impervious to staff turnaround, as well as guidance on further maturation of the program as the organization grew. These elements provided the rightsizing needed to prevent costly over-building or risky under-building of the framework.

Regulatory actions in 2023

Bank failures in 2023 have prompted regulatory action after some financial institutions failed to appropriately assess risk. In fact, postmortems on the failed institutions criticized the fact that the regulators had identified some issues but gave the banks too long to remediate them, suggesting that regulatory timeframes to resolve identified issues will continue to shrink.

These failures have prompted concern among depositors and financial institutions alike. In today’s world of instant communication and digital access to accounts, even the perception of weak risk management can cause panic among depositors. Financial institutions must prioritize robust model risk management to protect their investments and reputations.

Learn more about the 2023 banking crisis:

Recent bank failures: Implications for the financial institutions ecosystem, RSM article

Lessons from recent bank failures: Where do we go from here?, RSM webinar

2023 Banking Crisis: US by the numbers, The Conference Board report

A ground-up approach by an experienced and seasoned team

The RSM team brought several assets to bear to the project:

Industry experience. including team members with deep experience working in financial institutions and dealing with regulators on exactly the issues the bank faced. These professionals are familiar with coordinating with an institution’s business unit and working within resource constraints. In fact, one team member led the model risk function at a large, regional publicly traded institution prior to joining RSM.

Data analytics know-how. RSM’s data team of “quants” helped validate and monitor complex models involving machine learning, logistic regression, and other elements. The data analytics team also provided feedback on the bank’s validation and ongoing monitoring processes.

Up-to-the-moment domain knowledge. RSM’s team frequently liaises with multiple agencies and shares feedback among teams across regions and across the entire firm. RSM closely tracks trends at a national level to ensure the team properly adjusts the approach to incorporate or appropriately cover new risks as they arise and maintains a Model Risk Center of Excellence for knowledge transfer and best practices.

RSM took a multi-stage approach to the engagement, starting with gap assessments of the bank’s current model risk management program to understand what needed to be addressed and in what order to provide the greatest value. Based on this assessment, RSM assisted with the build-out of a comprehensive model risk management program, executing individual programs by first creating an inventory to identify and categorize all models and near models within the organization. RSM’s team then performed risk assessments on individual models to help identify the nature and frequency of risk management activities before defining or performing ongoing monitoring activities.

Knowing that the regulatory clock was ticking, the RSM team organized its approach by determining which issues to address immediately, as well as which processes could proceed on parallel paths. The goal was not only to ensure that there was a robust framework as well as policies and procedures that would stand up to regulatory scrutiny but also to begin execution of the first iteration of the model risk framework. Then the regulators could see examples of how it worked and request feedback. The hope, of course, was to pass the examination, but if not, to incorporate those additional adjustments into the framework.

After engaging with RSM, the organization was able to clear the outstanding MRAs and MRIAs and receive a positive CAMELS score. Better yet, they could rest easy knowing that the modeling had improved their risk profile.

Regulatory compliance goes beyond

Passing a regulatory examination is a high-five moment, but it’s only part of the value of a robust model risk management framework. In the end, this organization discovered how a disciplined approach to model risk management increases the value of its highly utilized models and improves the decisions they affect. Strong risk management benefits everyone. It helps the organization improve efficiency, make better decisions and achieve strategic objectives.