Governance: Model Risk, Accountability and Data#

The three lines of defence#

Banks organise their risk management in three lines. Regulators expect the lines to be separate, and expect each to be effective.

The three lines of defence#
Line	Role	Valuation examples
First line	The business and its support functions own the risks and the controls on a day-to-day basis.	Front office pricing and marks, and the technology that supports them.
Second line	Independent oversight and challenge of the first line, which sets the policies and monitors the risks.	Market risk, model validation, risk and compliance functions. In many banks, independent price verification is in the control functions, which are independent of the front office.
Third line	Independent assurance to the board on whether the first two lines work, which is internal audit.	Audits of the valuation control framework and of the models.

The placement of valuation control differs between banks. In some, it sits in Finance or Product Control, and in others in Risk. What matters to the regulator is that it is independent of the people who set the marks and that it has the authority to challenge them.

Model risk management: PRA SS1/23#

Model risk is the risk of loss, or of a wrong decision, from a model that is wrong or is misused. In the UK, the PRA’s supervisory statement SS1/23 sets out its principles for banks with internal model approvals for capital, and it has applied since May 2024. It covers all models, including those used for valuation, and not just the regulatory capital models. It has five principles:

The five principles of SS1/23#
No.	Principle	What it asks for
1	Model identification and risk classification	A model definition, a complete inventory of models, and a tiering of each model by materiality and by complexity.
2	Governance	Board and senior management responsibility, with a model risk policy and a named senior manager responsible for the framework.
3	Model development, implementation and use	A sound design, with data quality, testing, documentation, and controls on the use of the model, including the limits of its use.
4	Independent model validation	Validation by people who are independent of the development, which is proportionate to the tier, and ongoing monitoring.
5	Model risk mitigants	Adjustments, reserves and limits when a model has weaknesses that cannot yet be corrected. These are the model reserves that valuation control uses.

The US equivalent is the Federal Reserve and OCC guidance SR 11-7, which was the model for much of the UK approach. The EU relies on rules for specific models, and the ECB has guidance on internal models.

The Senior Managers and Certification Regime#

The SM&CR is the UK’s accountability regime for the financial sector. It makes named individuals personally responsible for the areas they run.

Senior Managers Regime: the most senior people hold a specific senior management function (SMF) and are approved by the regulator. Each has a statement of responsibilities, and the firm keeps a map of responsibilities. A senior manager has a duty to take reasonable steps to prevent a regulatory breach in their area.
Certification Regime: the firm certifies each year that other staff in roles that could cause significant harm, such as material risk takers, are fit and proper.
Conduct Rules: a set of basic standards of behaviour, for example to act with integrity, with due skill, care and diligence, and to be open with the regulators, which apply to almost all staff.

The effect is that a failure of valuation controls can be traced to a person, and the managers of the process have a reason to maintain evidence of the controls and the reviews that they do.

Data governance: BCBS 239#

The Basel Committee’s principles for effective risk data aggregation and risk reporting (BCBS 239) were written after the crisis, when banks could not quickly work out their exposure to a given counterparty. They are guidance from the Basel Committee, published in 2013 alongside Basel III, and not part of the Basel III capital rules. They apply to the largest banks, and supervisors such as the PRA expect compliance. The principles ask for:

Governance and architecture: a clear owner for the risk data, and an infrastructure that can support it, including in a stress.
Accuracy and integrity: data that is accurate and reconciled to the sources, with controls that are as strong as those for accounting data.
Completeness, timeliness and adaptability: all material risks are included, in time for decisions, and the bank can produce data in an ad hoc request.
Reporting: reports that are accurate, clear and useful, which are given to the right people.

Valuation relies on the same market data, trade data and reference data as the risk and finance reports, so these are the principles that justify investment in a single, controlled data source.

Timeliness, completeness and accuracy#

Three words recur across the rules in this series: timeliness, completeness and accuracy. They are the basic tests of any number or report, and each regime applies them in its own way:

The three tests across the regimes#
Test	BCBS 239 (risk data)	SOX (financial reporting)	IPV (valuation control)
Accuracy	Risk data is accurate, reconciled to the source and the accounting data, with the controls to match.	The amounts and periods in the report are right, and the control that uses the data is tested on it.	The mark is within tolerance of the independent price, and the source of that price is reliable.
Completeness	All material risks and positions are captured, including the exposures that are hard to aggregate.	The report that feeds the control includes all the items that it should (completeness of the information produced by the entity).	Every position in scope is verified, and none are missing from the population.
Timeliness	Risk reports are available in time to decide, and the bank can produce data quickly in a stress.	The control operates at the frequency that it is designed for and before the accounts are issued.	The verification is done before the P&L and the reports are finalised, and breaks are resolved within the policy time.

The same position data, market data and controls serve all three, so a failure in one place is likely to show up in each of them. A position missing from the IPV population, for instance, is a completeness failure for the valuation control, for the SOX report and for the risk aggregation. See Sarbanes-Oxley: Internal Controls over Financial Reporting for how auditors test it.

UK, EU and US compared#

Governance requirements by region#
Topic	UK	EU	US
Model risk	PRA SS1/23.	Supervisory expectations, including the ECB guide to internal models.	SR 11-7 from the Fed and OCC.
Individual accountability	SM&CR.	Fit and proper rules at national level, and no regime like the SM&CR.	Enforcement actions against individuals, with no formal regime.
Risk data	BCBS 239 expectations from the PRA.	BCBS 239, with ECB supervision of compliance.	BCBS 239 applies to the largest banks, under the Fed’s supervision.
Internal control over financial reporting	UK Corporate Governance Code board declaration on material controls.	No single equivalent. National rules and the audit committee.	SOX sections 302 and 404. See Sarbanes-Oxley: Internal Controls over Financial Reporting.

A valuation control view#

Valuation control is directly affected by each of these rules:

Independence: a clear reporting line, so that the second line can challenge and escalate. See Conduct and Market Abuse.
Model inventory and reserves: the valuation models used in the book should be in the model inventory with a tier, a validation and a documented set of limitations, and the reserves that address these should be calculated and approved. See Prudent Valuation.
Accountability: a named senior manager for the valuation process, a statement of the scope, and the evidence that the controls are operated, such as the sign-off and the escalation of breaks.
Data lineage: for each valuation input, a documented source, a check that it is complete and accurate, and a way to trace it from the reported number to the market data. This is the evidence that IPV needs, and it is also what BCBS 239 asks for.
Controls over financial reporting: the key controls over fair value are tested every year for the financial statements. See Sarbanes-Oxley: Internal Controls over Financial Reporting.
Reporting: the results of the valuation controls, the exceptions and the Level 3 and reserve movements should reach governance forums in a clear and timely manner.