Bank CROs are wrestling with a dilemma. While budgets are tight and getting tighter, model risk management (MRM) costs are rising relentlessly. But why and what can be done to bring it under control?

The latest FED Supervision and Regulation Report cites model risk management as a “significant nonfinancial weakness.” So model risk management is likely to remain under very close scrutiny.

Okay, so how does a CRO react if the regulatory focus isn’t going away any time soon? One approach might be to identify as few models as possible. But a complete and accurate inventory of models and a rigorous risk scoring approach is a key requirement of SR11-7 and usually the first thing scrutinized by any regulator or examiner.  And most banks are finding that their model inventory growth is seemingly unstoppable.

Oh dear. So if the regulatory focus remains, and the number of models is increasing, costs can only really be constrained by doing more with less.

It is fairly commonplace to find banks employing armies of MRM professionals for a relatively small number of models. It is not uncommon to have one FTE per 15 models. I know of one IHC bank with 600 identified models and 58 MRM professionals!  Even small banks (~$15bn in assets) have similar ratios. I know of one with 70 identified models who has hired three MRM professionals with the expectation of hiring more in the foreseeable future. MRM professionals are highly trained and therefore expensive. And these expensive heads are not helping the bank’s efficiency ratios.

So the problem in a nutshell: Relentless regulatory scrutiny, inventories increasing and a large number of expensive (over-worked) MRM FTEs!

The solution in a nutshell: Automation! But where? Most MRM teams think they are using automation but what they usually have is a repurposed GRC system, which at its best acts as a record of (all that manual) activity.

But there is hope and here are a few ideas for your consideration. I have outlined the prevailing “labor-intensive approach” we see at many, many banks. The “automated approach” addresses the same underlying intent and uses far less human labor to implement.

Model Inventory

Labor-intensive approach: The MRM team invariably has to meet with model developers, owners and lines of business (LOBs) and ask them to identify their models. Or perhaps a questionnaire is emailed, which requires chasing for answers.  And despite all these efforts, no one is sure that the data collated is complete or accurate. This process has to be repeated to ensure changes are captured. But it’s so manual that the updates only happen periodically and the inventory quickly becomes stale… (Is this a good use of expensive human capital?).

Automated approach:  ClusterSeven emails all users with a browser-based attestation questionnaire. Nothing to log-in to and nothing to install on the user’s PCs. All inputs and answers are held centrally. The MRM team has real-time reports on completeness and gaps. Out-of-the-box automated workflows ensure each LOB validates its own inventory before the MRM team needs to review it. ClusterSeven’s scanning and discovery are then used to verify that nothing was overlooked.  This ensures a sustainable, low resource and accurate method for finding and inventorying your models. And while you are here, why not inventory your important non-models aka Tools, Calculators and end-user developed applications, so you can really understand what is going on across the business.

Model Risk Ranking

Labor-intensive approach:  The MRM team, using a risk scoring function, interviews each model developer, owner & associated documentation. This resultant risk score is, of course, heavily reliant on the interviewee’s veracity.

Automated approach: As the developer/owner/user describes their models in ClusterSeven, a real-time risk algorithm, which incorporates the scoring algorithm, automatically grades each model based on the user’s inputs. ClusterSeven can also technically interrogate certain models and automatically rank the application based on formulas, links, code etc. A belt and braces blend of user input (qualitative) and technical analysis (quantitative).

Model Validation

Labor-intensive approach: The inability to know if a model has changed forces most banks have to rely on a strict honor system. Model owners have to inform MRM of any changes and, if significant, the changes must be reviewed before going into production. Otherwise, MRM defers to a calendar-based review with high-risk models typically get an annual review, medium risk every two years, low risk every three years etc. Failure to inform MRM may carry serious penalties, particularly if regulators uncover the changes, but at its heart, the current practice relies on honesty or a calendar!

Automated approach: ClusterSeven can automatically monitor models, 24/7. Our solutions can even fire real-time alerts if a significant change is detected enabling LOB management and MRM teams to respond accordingly. This removes doubt and delay and empowers your bank to react before a potential mistake causes losses or reputation damage.

Model Data Flows and Dependencies

Labor-intensive approach:  Knowing where a model’s data is sourced and used is obviously critical.  But again, the common approach is to interrogate the documentation, its developers, owners and perhaps even users and then draw the flowchart in Microsoft Visio or similar. What do you do if the model has been in production for years and where the present owner/user(s) were not the original developers?  Does anyone really understand all the links, connections and data flows? Very manual, very unreliable and out of date as soon as the ink dries.

Automated approach: ClusterSeven enables model developers & owners to connect models and data sources within the MRM inventory. These can be easily updated, changed and augmented as and when changes are necessary.   This creates a live, accurate display of connections both into and out of each model. The MRM team can even test this using our “spider-mapping” utility to automatically scan all links. The evidence can be used to challenge the model developer, owner and line of business if differences are found.


The level of automation available to MRM teams often comes as a surprise to CROs and management. But how much would this automation actually save your organization?  We have developed an ROI calculator that factors in the total number of models and where automation can be used to reduce manual labor, time and therefore cost. Banks with an inventory of models in the 50 to 250 range can realistically see an ROI measured in 6-8 months. Do reach out to me if this is of interest.


Get In Touch

Let's talk about how you can control your Shadow IT.