Model validation in Switzerland

24 Jul 2019

Background

Are you aware of all the models that banks are currently using in Switzerland? And are you familiar with the associated maintenance and validation requirements?

These days, banks (and securities dealers) in Switzerland use a variety of models for risk management, for business decisions and regulatory reporting purposes (see table below). As the Swiss regulator (FINMA) approves and monitors the use of many of these models, banks need to comply with additional supervisory parameters.

Credit parameters Credit risk Market risk Operational risk
PD (Logistic Regression)
SA, IRB-F, IRB-A VaR, IRC, Exp. Shortfall BIA
LGD (Specific Models) Economic Risk Capital Greek Sensitivities SA
EAD (SA-CCR, IMM) IFRS 9 Impairment FRTB AMA
ALM/treasury Liquidity risk Value adjustments Stress testing
IRRBB (EVE, NII) Liquidity-adjusted VaR CVA, DVA CCAR (FED)
Behavioural Models Intraday Monitoring FVA, COLVA Stress Test (PRA)
Replicating Factors Liquidity Risk KVA, MVA Capital Planning

With growing regulatory challenges and increased complexity, all these models require independent model validation. This raises questions about resources and competences, and leaves banks with a new category of risk: model risk.

Model risk is the potential for adverse consequences of decisions based on incorrect or misused model outputs and reports. The result can be financial losses, poor business and strategic decision-making, or damage to a bank’s reputation.

Independent model validation mitigates model risk for banks by identifying fundamental errors and avoiding the incorrect use of models and inaccurate outputs. It provides senior management and the Board of Directors with assurance, and fulfils the regulatory requirements regarding independent model validation.

Unlike the largest players in the Swiss market (such as FINMA-supervised category 1 and 2 banks), many Swiss banks do not have their own model validation framework and/or teams with in-house expertise to validate their models.

Although it is usually the CFO or CRO who owns the models, the ultimate responsibility remains with the Board of Directors. This is because the outputs of many models are used to fulfil regulatory capital and liquidity requirements for which the Board is ultimately responsible.

New mandatory independent model valuation for Swiss banks

Since 2011, major financial supervisors and international authorities, such as the FED, BIS, ECB and PRA, have issued diverse regulatory publications that set out principles for the effective management of banks’ model risk by validating models. Before 31 December 2018, the only recommendation in Switzerland was to set up a model validation framework by referring to the publications of foreign standard setters (see table below).

Authority Year Publications on model risk Description
FED 2011 Supervisory Guidance on Model RiskManagement (SR 11-07)  Comprehensive supervisory guidance with principles on effective model risk management
BIS 2012 The Internal Audit Function in Banks (BCBS 223) Principles on supervisory guidance to assess effectiveness of internal audit
EBA 2014 Supervisory Review Evaluation Process (SREP) Comprehensive assessment of banks’ strategies, processes, risks and capital planning 
ECB 2015 Targeted Review Internal Models (TRIM) Guidelines to reduce inconsistency and variability of capital required when banks use internal models
PRA 2017 Model Risk Management Principles for Stress Testing Principles on model risk management for banks relying on internal models to perform stress tests

FINMA-circular 2017/1 assigns responsibility for developing and operating risk monitoring systems, defining and applying principles and methods for risk analysis and assessments (e.g. validation of models) to the risk management function.

On 1 January 2019, FINMA issued its revised circular 2019/2mon the Interest Rate Risk in the Banking Book (IRRBB). The circular implements the global IRRBB principles issued by the Basel Committee for Banking Supervision (BCBS) for Swiss banks. It requires independent validation of risk measurement systems and models, for example asset and liability management tools for interest rate risks. Although FINMA allows smaller banks to apply some simplifications, independent validation is required for such systems and models for all Swiss banks at least every three years or in the event of a significant change in the data, system, models and parameters.

Our services: how we can support you?

New risk management, business and regulatory requirements raise various challenges in terms of the effectiveness of banks’ model risk management. This will require diverse expertise and more resources. To help banks develop their model risk management framework and run model validations, PwC offers ‘one-off’ validation services, benchmarking and a fully outsourced managed service.

PwC teams of model risk experts with a technical background and proven experience provide assurance to CFOs, CROs, Executive Management, Risk Committees and/or Board of Directors on the adequacy on the adequacy and efficiency of the bank’s controls designed to reduce model errors. PwC can provide such services to non-audit clients in each of the three lines of defence (LoD), depending on the requirements of the bank:

A bank’s management benefits from PwC’s network to benchmark approaches in use in countries where standard setters require more comprehensive and more frequent stress testing results from supervised banks than in Switzerland. With our global practice, PwC has a strong track record in supporting banks with ECB stress testing, the implementation of IFRS 9 and CECL, TRIM Margin of Conservatism and IRB models.

Banks have the option of outsourcing the model validation function to PwC. In such cases, independent and dedicated PwC teams take charge of the end-to-end model validation process, while banks focus their efforts on their core business and risk management. This way banks benefit from PwC’s industry-wide experience, can maintain high quality standards and gain increased confidence in model risk management. Additional factors to consider are ensuring service continuity, tracking industry developments and maintaining critical team sizes – all of which can be difficult to maintain internally for such a specialised task. It can therefore be effective and efficient to outsource this alongside the core model validation work.

Management decisions: independent model validation by whom?

CFOs and CROs of Swiss banks might face a dilemma. It can be challenging to identify individuals internally who are independent enough or have the time, flexibility and skills to validate models. At the same time, model validation may not require a full-time headcount. Banks need to have clear views about which activities could be performed more efficiently and/or at lower cost by a third party.

Regarding its own staff, banks may choose to either recruit employees (separate from the teams of developers) who will focus on the independent validation of models or rely on independent external consultants who perform model validations as and when requested by the bank.

Intuitively, banks may look to their third line of defense (such as internal or external auditors) to validate their models. However, given that independence requirements of auditors are not commensurate with model validation work, management needs to look into alternative solutions in their second level of defense.

The IRRBB validation requirements might only be a precursor for similar tasks that might reach banks now or in the future for prudential purposes. This could include, for example, stress testing of the Swiss real-estate market or of other emerging risks, which may attract the attention of official bodies in Switzerland and, therefore, require modelling and validation.

Additionally, banks might deploy additional models in the future for internal risk management and decision-making purposes. Such models require independent validation to ensure that the results are fit for purpose and remain so.

To this end, banks should consider all its models’ lifecycle phases to ensure that adequate model risk management and best practice principles are applied. The table below gives a flavour of industry best practice for initial validation and periodic revalidations:

Model validation Best practice
Scope and objectives
  • Models have a defined purpose and clear decision rules
  • Scope of models’ application, methodology, data sourcing and IT environment are specified and approved in advance
Governance
  • Roles and responsibilities relating to ownership are defined
  • Model validation policies, procedures and monitoring are effective
  • Independent committees are created
Model assumptions and limitations
  • Models use reliable inputs with sufficient data quality
  • Experts understand limitations and assumptions of models and provide judgements
Model selection, implementation and use
  • Models are suitable based on expert judgements
  • Models are appropriately designed, implemented and tested within the IT environment
  • and approved by committees
Model’s fitness for purpose
  • Implemented models rely on appropriate methodologies that are ‘fit for purpose’
  • Models reflect regulation and current industry practices
Monitoring model performance
  • Deviations or changes are assessed, including performance deterioration or changes in
  • product definition
  • Back-testing and monitoring of KPIs and KRIs are performed
Corrective measure to address findings
  • After identification of issues, corrective action plans are approved by committees before
  • implementation
  • New models are validated and documented before use
Transparent model impact evidence
  • Deviations and validation issues are properly captured
  • Findings are clearly documented, reported to management and committees, and escalated as required
Model documentation and inventory
  • A model inventory stores all existing models by type, use and objective
  • Lists all model versions, uses, assumptions, data sources, key inputs and validation findings
Appropriate documentation processes
  • Documentation required for every change affecting models
  • Models are subject to independent and adequately documented validation

In sum, we recommend to set up a sound model validation framework. This should include policies for model risk management, the objectives and scope of the models, and the management of model risk throughout its entire lifecycle. This is illustrated in the diagram below:

Our credentials

PwC in Switzerland already provides model risk management and validation services to a number of banks in Switzerland as part of various audit and advisory mandates. In parallel, PwC Switzerland has developed diverse tools to perform independent calculations and analyses of capital, liquidity and interest rate risks. These tools are available for an efficient approach to model validation.

PwC’s independent team of experts can provide a regular overview of the models’ assurance to the Board and management. To this end, we produce comprehensive dashboards of aggregated scorecards covering both compliance and the reliability of the outcomes.

Overall, banks benefit from PwC’s proven efficiency, resources and insights in model risk management and validation − spanning credit, market, operational, interest rate and liquidity risks, as well as accounting provisions for expected credit losses and stress tests.

 

Contact us

David Faria

David Faria

Financial Risk Management, PwC Switzerland

Tel: +41 58 792 27 85