Identify responsibilities and set key controls for model risk

Of course, a strong and independent risk oversight group is the first step towards
fighting model risk. Given the range of models, assumptions and data used in any
bank, such a group has a substantial role to play. But risk managers often lack the
time and resources to effectively accomplish a comprehensive and extensive model
review, audit and test. It is therefore extremely important to define relevant roles and
responsibilities, and to establish a written policy on model adoption and use. The
policy should typically define who is able to implement, test, and validate a model,
and who is in charge of keeping careful track of all the models that are used, knowing
who uses them, what they are used for, who has written the mathematics and/or
the code, who is allowed to modify them, and who will be impacted by a change. It
should also set rules to ensure that any change is verified and implemented on a
consistent basis across all appropriate existing models within the institution. Without
this, installing new software or performing a software upgrade may have dramatic
consequences on the firm’s capital market activities.