Back in April, the Prudential Regulation Authority (PRA) published its Supervisory Statement (SS 3/18), setting out its expectations as to the model risk management practices that firms should adopt when using stress test models. The SS became effective on 1st June 2018.
The SS is relevant to PRA authorised banks, building societies and PRA designated investment firms, but notably, not credit unions, nor any PRA authorised firms in the insurance or reinsurance sectors.
It is effectively an extension of the principles that the PRA applies to those larger firms that participate in the Bank of England’s (BoE) annual concurrent stress testing, however for firms excluded from this, a more proportionate approach is prescribed, considering their size, complexity, risk profile and the importance and relevance to them of stress testing.
The PRA’s model risk management principles for stress testing are centred on four key principles:
- Firms should have an established definition of a model and maintain a model inventory.
- Firms should have an effective governance framework, policies, procedures and controls to manage their model risk
- Firms should have a robust model development and implementation process and ensure appropriate use of models
- Firms should undertake appropriate model validation and independent review activities to ensure sound model performance and greater understanding of model uncertainties.
As mentioned earlier, the PRA expects a proportionate approach to be adopted and firms should follow a risk-based approach to determine the materiality of models focusing on two main factors: coverage (for example, the size of a portfolio) and impact (for example, the financial or capital), with consideration being given to the model risks associated with the models, e.g. complexity, purpose or strategic importance of the model.
Whereas the larger firms involved in the BoE annual concurrent stress testing exercises are expected to apply the principles for all stress test models, smaller firms are required to take into account their nature, scale, complexity of business activities and use of stress test models when seeking to apply the principles, subject to the following minimum benchmarks:
- all firms should implement Principles 1 and 2 (i.e. establish a model definition, maintain a model inventory and implement an effective governance framework, policies and procedures), and
- firms should apply Principles 3 and 4 (i.e. implement a robust model development process and undertake validation and independent review) to those models they consider material and pose the most significant risks to their business. Ultimately, the focus should be on those models that pose the most significant risks – financial, capital or other – in ensuring that they are adequately managed.
For the larger firms, oversight and feedback on their model risk management practices will form part of the BoE’s qualitative review of the annual concurrent stress tests. For the other firms, the PRA will review stress test model risk management practices as part of the Supervisory Review and Evaluation Process (SREP). The PRA’s assessment will form a further pillar of its supervisory assessment of risk management and controls and governance and culture as set out in ‘The PRA’s approach to banking supervision’, published in March 2016.
Importantly, all firms applying the principles are expected to do a self-assessment of their stress test model risk management practices against the principles as part of their internal capital adequacy assessment process (ICAAP) and report their findings in their ICAAP documents from the beginning of 2019.
So what does all of this mean?
All organisations who will be newly impacted by the SS will need to take a good look at the principles and ask themselves if they really could confidently say to the regulator that they are totally comfortable with the requirements and more importantly are able to demonstrate compliance.
Over the coming weeks our model risk team will look at the principles in a little more detail and will shine a light on each of them in turn. They will also provide some hints and tips for compliance as well as their insights on the common pitfalls and how to achieve best practice.
In the meantime, if you would like to talk to our team who work closely with PRA regulated clients, or our experts in the model risk team then please get in touch.