Managing the Risks Associated with Models: Accountants in All Industries Can Play a Meaningful Role in the Mitigation of Model Risk at Their Organizations

Models are everywhere. Many organizations use models for facilitating the decision-making process, for accounting and tax purposes, and for managing day-to-day operations. In fact, organizations are increasingly running their businesses with models for a range of life cycle purposes, such as valuation, loan decisions, inventory management, reserving, acquisitions, customer behavior, and other financial and nonfinancial decisions. It's important for accountants to understand the model-use environment in their organizations because models can significantly affect the financial statements. Managing "model risk," which is the risk of financial loss, erroneous financial statements, improper managerial decisions, or damaged organizational reputation, resulting from poorly built, used, or controlled models, can be costly and challenging. For example, if the input data or assumptions used in an allowance model for estimating reserves are incomplete or inaccurate, the resulting model output could cause an accounting error. Alternatively, if the model theory underpinning the credit valuation adjustment portion of a derivative instrument's fair value estimate is unsound, the financial statements and fair value footnote could be misstated. Model risk management (MRM) is a branch of risk management that addresses these concerns. It is a structured approach that defines roles, responsibilities, policies, procedures, and controls to mitigate the potential adverse impact of the model-use environment. It was brought into sharper focus in the past decade, as unmitigated model risk associated with collateralized debt obligations and associated default swaps may have contributed to the 2008 financial crisis, and because regulators have indicated that models were at least partially to blame for other widely publicized financial institution failures. Regulatory guidance applicable to the banking sector and some insurance companies issued by the Office of the Comptroller of the Currency and the Federal Reserve, such as SR 11-7, Supervisory Guidance on Model Risk Management, has precipitated the recent evolution of MRM leading practices. However, while financial services organizations have established the most formally implemented MRM programs, the lessons learned and practices developed are relevant for other sectors. For instance, the principles that drive the control activities that manage the risk associated with a bank's credit risk models or an insurance company's pricing or reserving models can be applied to the controls and risk management activities related to a retail company's predictive analytics model for customer behavior, a manufacturer's supply chain model, or an oil and gas company's price optimization or demand forecast models. Moreover, the accounting life cycle often depends on models used across industry lines, such as tax, goodwill impairment, fair value, and reserving models. MRM FUNDAMENTALS Oversight by the board of directors and involvement of senior management serve as the linchpin in a sound MRM environment. Their ownership and involvement in critical MRM decisions, such as those that could materially impact the organization, set the tone that MRM is taken seriously by the highest levels of the organization. Defining roles and responsibilities, outlining mandates and guidance within formal policies and procedures, and establishing internal controls to mitigate model risk are the initial steps in establishing the foundation of an MRM governance framework. Many organizations that have implemented formal MRM programs use a "three lines of defense" approach to managing model risk, where organizational stakeholders are tasked with checks and balances to reduce model risk. First line of defense Model developers, who often are also the line-of-business model users, represent the first line of defense and are responsible for developing models based on formal internal standards and requirements; testing the models, their inputs, and implementation; documenting the theoretical underpinnings of the models and the rationale for choices regarding inputs and assumptions; and monitoring the models' performance once they are in use. …