Is Your Board Truly Engaged with Model Risk?

The question isn’t whether your board should care about model risk – they recognize they are meant to. The more pertinent inquiry is whether the board, and the leadership structure beneath it, genuinely understands models as critical decision-making tools requiring careful oversight, given that their weaknesses can impact capital, pricing, and risk appetite. This unease is often felt, but rarely voiced, by senior model risk executives.

The Shift from Compliance to Core Discipline

For many banks, model risk management has historically been treated as a necessary, yet cumbersome, control function primarily designed to satisfy regulatory expectations and avoid adverse findings from supervisors. As long as no visible failures occur, senior management attention often drifts elsewhere. Even when model risk teams identify significant problems, these issues can struggle to gain traction at the highest levels unless regulators intervene.

This dynamic is evident in the ongoing debate surrounding the US Federal Reserve’s SR 11-7 guidance on model risk management, issued in 2011. The Bank Policy Institute, reportedly at the behest of senior executives from large US banks, has advocated for scrapping SR 11-7, a move that has sparked concern among model risk managers.

Priorities and the Revenue Engine

Acknowledging the realities of business, some risk managers concede that banks naturally prioritize functions that generate revenue and returns. Boards aren’t expected to elevate every control function above the commercial engine of the firm. Model risk was unlikely to surpass revenue generation, business expansion, or client strategy in the competition for senior attention. This prioritization, however, can inadvertently lead to a culture of waiting for regulatory action to address serious weaknesses.

In some instances, model outputs aren’t used as evidence to inform decisions, but rather as a means to support pre-determined conclusions. When outputs reveal inconvenient truths, there’s sometimes pressure on model risk teams to adjust results to align with desired outcomes, rather than questioning the underlying business decisions. This represents a reversal of the intended discipline that model risk is meant to impose.

Gaining Board Attention: Speaking the Right Language

Model risk executives recognize that relying solely on traditional governance scripts – challenge, regulatory expectation – is no longer sufficient. To remain relevant, they must communicate in the language of the board: efficiency, automation, scalability, and execution. This doesn’t indicate positioning the function as a profit center, but rather demonstrating how it supports broader organizational goals.

Many boards are focused on maximizing resources, streamlining processes, and leveraging artificial intelligence (AI) to improve operational efficiency. Model risk teams that can showcase their ability to support these initiatives – through automated testing, faster validation cycles, and streamlined governance – are more likely to be heard. The key message is that robust control doesn’t necessarily equate to operational drag.

The AI Paradox

This creates a tension: AI promises speed, automation, and scale, all of which appeal to boards. However, AI systems are themselves models, often complex and opaque. If model risk is treated as a secondary control function, the gap between what banks believe their models are doing and what they are actually doing could widen. In an era of rapid technological adoption and potentially easing regulatory pressure, this disconnect could prove costly.

Culture and Leadership Matter

Risk culture varies significantly across banking institutions. Some banks consistently demonstrate a stronger commitment to taking model risk seriously. Barclays and JP Morgan are frequently cited as examples of organizations where model risk teams feel their work is valued, not merely tolerated.

The experience of model risk managers appears heavily influenced by the tone set by senior leadership, particularly the background of the chief executive officer (CEO) or chief risk officer (CRO). Banks with CEOs or CROs comfortable with quantitative issues tend to foster a different organizational message.

A former model risk head at a large US bank noted, “If a bank doesn’t really believe in independent risk challenges, it will often appoint someone from the business as CRO – someone who ‘understands us’ and will produce sure risk doesn’t get in the way. That’s the wrong way to choose a CRO.”

Barclays, with its CEO CS Venkatakrishnan’s prior experience as the bank’s CRO and in JP Morgan’s risk division, may exemplify this approach. Banks that prioritize risk governance tend to select CROs precisely for their independence, strong viewpoints, and willingness to express them, creating a consistent stance on the importance of risk functions across the C-suite.