Increased Resilience Driving Business Value: The Role of Integrated Data and Analytics in Model Risk Management

INCREASED RESILIENCE DRIVING BUSINESS VALUE: THE ROLE OF INTEGRATED DATA AND ANALYTICS IN MODEL RISK MANAGEMENT

By Muzammil Shabudin, Head of Risk Advisory for SAS UK & Ireland

Whilst latest market indicators may suggest recent volatility and uncertainty are cooling, the persistent threat of sudden market shocks are now a seemingly constant challenge for UK financial institutions. So, a sharp board-level focus on operational resilience – by design – is key.

To achieve this, there is an array of different elements organisations need to consider. From how they can remain competitive, to avoiding regulatory penalties – establishing more robust data and model risk management (MRM) practices are central to long term success.

A changing landscape

We are all aware of the MRM regulations that are due to come into force in a matter of weeks and this will be a key moment for the UK financial services industry.

From 17 May 2024, organisations in scope must abide by the Bank of England’s Model Risk Management Supervisory Statement SS1/23, a set of principles that outline the regulator’s expectations regarding firms’ MRM practices.

These regulations come after years of calls for the industry to do more to stabilise itself in the wake of the Global Financial Crisis and subsequent market shocks. Only last year we saw the collapse of Silicon Valley Bank and Credit Suisse – highlighting that no organisation is immune from the impact of ineffective governance processes.

Despite The Bank of England having been firm that the UK’s banking system is robust, it did admit that any lasting impact on bank funding costs could harm the nation’s financial stability, warning the impact of financial market volatility could expose weaknesses in the UK’s financial system.

Data quality and evolving technology

To avoid regulatory penalties, organisations need to be investing in technology that can enable integrated and more explainable decision-making. Alongside pressure from regulatory bodies, research has found that the financial cost of poor quality data typically costs organisations between 10% and 30% of revenue. This is due to the additional risks that emerge from a lack of data lineage and governance, including inaccuracies in source system design and underlying control issues.

There’s also the non-monetary costs to consider such as strategic decisions where the benefit of diversity of thought is limited, increasing the risk of reputational damage. According to Experian’s 2021 Global Data Management Research report, 95% of businesses have experienced such impacts related to underlying poor data quality.

Specifically, navigating poor quality across the data lifecycle is a common challenge for UK banks, due to many well-known reasons. From many of the long-established financial institutions, problems range from over-reliance on legacy systems and siloed data, to data integration projects taking years to complete – given the impact of make- or break-career decisions, it’s sometimes just too high a risk for executives to run.

However, with AI-based models being used to increasingly inform strategic decision-making and automate operational processes, executives need to know the business can quickly identify and manage the risks associated with the use of artificial intelligence (AI) in modelling techniques such as machine learning (ML), but not everyone has a statistics degree. Should underlying data errors go unnoticed, a single anomaly can amplify and become much more difficult to fix – especially if the organisation is unsure where the error even originated.

Hence AI-model governance is one of the issues SS1/23 is aiming to address, with five key principles to ensure an effective model risk management (MRM) framework at the institution- and sector-level. These require a number of governance enhancements, including having to report on the effectiveness of MRM processes to the Audit Committee and appointing a single person to be responsible for the MRM framework.

Regardless of the quality of the data that goes in, if institutions are not continually reviewing their processes around model development, usage and reporting, there is a chance that these models become unfit for purpose over time. Effectively designed, carefully operated and appropriately validated model management processes are therefore central to a fit-for-purpose Enterprise Risk Management Framework.

Ensuring a level international playing field

SS1/23 largely follows regulation SR11-7 in the US, which for over a decade has been the set of governing principles regarding effective and robust MRM. The objective of the UK regulation is similarly to increase the overall stability of the UK economy. The European Banking Authority may choose to enforce similar regulations in time, perhaps after reviewing the impact of the introduction of SS1/23 on internationally active financial institutions.

The UK principles are intended to complement existing requirements and supervisory expectations, whilst addressing specific recently observed international shortcomings, in order to reduce the probability and severity of future similar crises across the UK and global financial sector.

However, forecasting and risk models can only work if the governance framework in which they operate ensures that any amendments or recalibrations that need to be made are identified in a timely manner. Hence the PRA’s consultation period with UK institutions prior to the finalisation of SS1/23, where responses were sought from domestically-focused as well as internationally active institutions. Good governance impacts all key decisions that any bank will need to make across their operating territories, such as strategic initiatives, financial performance, risk management, outsourcing and remuneration, which is why the impact of SS1/23 on UK and international operations is just as important as the guidelines themselves.

The new principles make boards explicitly accountable for promoting good MRM culture from the top down, setting clear model risk appetite, approving the MRM policy and appointing an accountable individual to be responsible for implementing a sound MRM framework. Many institutions have therefore promoted model risk into the ‘Level 1’ category – requiring the most direct level of board oversight, again, by design.

Taking action

SAS works with organisations across all aspects of the financial services sector, having partnered with over 80 banks to implement robust MRM processes.

With the Bank of England’s Model Risk Management Supervisory Statement SS1/23 coming into force on 17 May, which will apply to all UK banks, building societies and PRA-designated investment firms with internal model approval, now is undoubtedly the time for firms to adopt a more strategic approach – not only to MRM but across risk management, governance and control, to meet supervisory expectations and maximise opportunities to drive business value from regulatory compliance.