However, that confidence must be tempered by a proper understanding of model limitations and assumptions, which the use test indeed also requires. Insurers should try to de-mystify models as much as possible and avoid any sense that they are “black boxes”. They need to understand for what purpose a model has been developed and the boundaries of its legitimate application. Criticism of the model ought to be welcomed and followed up: for example, arising from independent validation. Stress testing should be used to explore and improve understanding of model weaknesses. Management should challenge the outputs of complex models using other simpler models, rules of thumb and expert judgement. 7 For example, internal model estimates of capital can be compared to simpler standard formula or leverage measures. We encourage insurers to develop their own model drift measures and not limit themselves to the PRA’s metrics. To take another example, in a rapidly changing world, it is good practice for insurers to pay close attention to claims 6  Model risk: illuminating the black box, British Actuarial Journal, 22 August 2017, R. Black, A. Tsanakas, A. D. Smith, M. B. Beck, I. D. Maclugash, J. Grewal, L. Witts, N. Morjaria, R. J. Green and Z. Lim. 7 In the Dog and the Frisbee, 2012, Andy Haldane and Vas Madouros explained how simple rules of thumb often outperform complicated models in complex, uncertain environments. https://www.bankofengland.co.uk/paper/2012/the-dog-and-the-frisbee  7  All speeches are available online at www.bankofengland.co.uk/publications/Pages/speeches/default.aspx  7  experience as a risk indicator.

Model risk can arise in two ways: from fundamental flaws in models and from misuse of models. Turning first to model flaws, the risk is not that the model is imperfect – that is inevitable. Rather it is that errors are so fundamental that the model produces inaccurate or undesirable outputs when viewed against design objectives and intended business uses. For example, an insurer’s internal model might produce a capital requirement that is significantly too low; or a pricing model might include analytical methods that lead to outcomes that are outside the insurer’s risk appetite or, in the extreme, in breach of regulations or illegal. The Model Risk Working Party of the Institute and Faculty of Actuaries have published two good papers on model risk.5 The second one6 relates the case of the loss of the Mars climate orbiter in 1998 as an example  4  Supervisory Guidance on Model Risk Management, SR Letter 11-7, Federal Reserve Board and Office of Comptroller of the Currency, April 4 2011 5 https://www.actuaries.org.uk/practice-areas/risk-management/disbanded-research-working-parties/model-risk 6  All speeches are available online at www.bankofengland.co.uk/publications/Pages/speeches/default.aspx  6  of flawed model design. The trajectory of the spacecraft had been incorrectly calculated, which meant that the spacecraft had actually been orbiting much closer to Mars than had been targeted causing the space probe to disintegrate in the planet’s atmosphere. The problem was as basic as the use of incorrect units in part of the navigation software. An external contractor had produced software to provide Thruster performance data in English units of pound-seconds.