Strengthening the role of the Validation function in the Nordics

The European Banking Authority (EBA) recently published a Consultation Paper on supervisory handbook on the validation of Internal Ratings Based (IRB) rating systems. The handbook outlines the most detailed requirements on the validation function to date. It also provides considerations between the roles of validation and internal audit function. A recent survey from Deloitte covering Nordic banks indicates that several adjustments are necessary for banks to comply with the handbook.

EBA identified that the expectations for the validation function have not been aligned across the European Union and the handbook aims to respond to that need. The paper is relevant reading especially for a financial institution’s independent validation unit (IVU), internal audit (IA) and credit risk control unit (CRCU). Based on previous European Central Bank (ECB) reviews and regulatory observations in the market, the handbook outlines the most detailed requirements on the validation function to date. It also clarifies the supervisory requirements for the roles and responsibilities especially between IVU and IA.

Bringing clarity on the role of the Independent Validation Unit (IVU)
EBA’s handbook consults on minimum supervisory expectations with respect to IRB validation. The most relevant aspects address internal governance and the validation framework. Given possible new and additional regulatory expectations, we strongly recommend the IVU, IA and CRCU within each institution to discuss the paper and identify potential gaps in the internal frameworks and governance.

The handbook outlines several expectations for the IVU, but we consider the following expectations for internal governance to be especially relevant for the financial institutions in the Nordics:

• Independence of IVU is ensured by structural independence and sufficient resource allocation.
• Validation activities need to be performed by IVUs of the respective legal entities where the IRB models are used.
• Roles, responsibilities and tasks between IVU and IA with regard to the assessment of the IT implementation, rating assignment process/review, data quality framework and the application of risk parameters should be clearly defined.

EBA also clarifies that, with respect to model changes, IVU is expected to assess the combined effects always in comparison to the last approved model i.e., before any non-material model change(s). Comparison to the latest submitted model can pose some challenges for institutions because it is not necessary the current implemented model. Usually, smaller non-material changes are implemented on an ongoing basis. In addition, it should be noted that the handbook outlines clear expectations to the performance testing by the IVU in the financial institutions e.g., testing the appropriateness of the grading structure.

In the draft validation handbook, EBA sets out six questions for consultation from the national regulators and financial institutions. The questions cover the split between:

1) the first and the subsequent validation scope,
2) validation of rating systems used across different entities,
3) responsible unit for review of the DoD,
4) rating philosophy in the back-testing,
5) empirical assessment of the modelling choices and the performance of the slotting approach, and
6) assessing the performance of the model in the context of data scarcity.

It is expected that following the 28 October 2022 consultation deadline, EBA will be providing clarification on these topics.

Higher prioritisation of the Independent Validation Unit needed
Model risk management continues to increase in importance, as banks rely on models more than ever. Ensuring a strong IVU will be key in maintaining high quality risk management. Therefore, Deloitte conducted a Model Risk Management survey between November 2020 and February 2021, with focus on the maturity of the IVU in the financial institutions. A total of 80 banks across Europe, Middle East and South Africa participated in the survey, including 17 Nordic banks. Several Nordic banks expressed their concerns on this topic, which can be summarised as follows:

• Resourcing: 65% of the banks (both Tier 1 and Tier 2) report inadequate staffing resources in model validation. 
• Completeness of the model inventories: None of the Nordic banks surveyed have complete model inventories, and half of the Nordic banks do not use the model inventory for repository of model documents or model lifecycle management.

The result of this survey shows that financial institutions in the Nordics still have some way to go towards maturing their IVU to ensure that there are enough resources assigned for challenging the internal models. In addition, institutions need to complete their model inventories to ensure an effective and adequate validation of the internal models. The IVU should therefore receive higher prioritisation over the next 1-2 years for financial institutions in the Nordics to comply with the EBA paper on validation.

How Deloitte can support

Given the concerns that many of the Nordic banks expressed in the Model Risk Management survey, there are areas that need to be developed to comply with the upcoming EBA Validation Handbook. Deloitte has performed several projects across EU and in the Nordics on MRM, validation, and internal audit. We are ready to support your organisation by providing Nordic and EU-wide benchmarks and best practices, conduct IRB validations, support with Model Risk Management frameworks, and provide insights regarding the roles of validation and internal audit functions.