The European Banking Authority (EBA) recently published a Consultation Paper on supervisory handbook on the validation of Internal Ratings Based (IRB) rating systems. The handbook outlines the most detailed requirements on the validation function to date. It also provides considerations between the roles of validation and internal audit function. A recent survey from Deloitte covering Nordic banks indicates that several adjustments are necessary for banks to comply with the handbook.
EBA identified that the expectations for the validation function have not been aligned across the European Union and the handbook aims to respond to that need. The paper is relevant reading especially for a financial institution’s independent validation unit (IVU), internal audit (IA) and credit risk control unit (CRCU). Based on previous European Central Bank (ECB) reviews and regulatory observations in the market, the handbook outlines the most detailed requirements on the validation function to date. It also clarifies the supervisory requirements for the roles and responsibilities especially between IVU and IA.
Given possible new and additional regulatory expectations, we strongly recommend the IVU, IA and CRCU within each institution to discuss the paper and identify potential gaps in the internal frameworks and governance.
EBA’s handbook consults on minimum supervisory expectations with respect to IRB validation. The most relevant aspects address internal governance and the validation framework. Given possible new and additional regulatory expectations, we strongly recommend the IVU, IA and CRCU within each institution to discuss the paper and identify potential gaps in the internal frameworks and governance.
The handbook outlines several expectations for the IVU, but we consider the following expectations for internal governance to be especially relevant for the financial institutions in the Nordics:
EBA also clarifies that, with respect to model changes, IVU is expected to assess the combined effects always in comparison to the last approved model i.e., before any non-material model change(s). Comparison to the latest submitted model can pose some challenges for institutions because it is not necessary the current implemented model. Usually, smaller non-material changes are implemented on an ongoing basis. In addition, it should be noted that the handbook outlines clear expectations to the performance testing by the IVU in the financial institutions e.g., testing the appropriateness of the grading structure.
In the draft validation handbook, EBA sets out six questions for consultation from the national regulators and financial institutions. The questions cover the split between:
It is expected that following the 28 October 2022 consultation deadline, EBA will be providing clarification on these topics.
None of the Nordic banks surveyed have complete model inventories, and half of the Nordic banks do not use the model inventory for repository of model documents or model lifecycle management.
Model risk management continues to increase in importance, as banks rely on models more than ever. Ensuring a strong IVU will be key in maintaining high quality risk management. Therefore, Deloitte conducted a Model Risk Management survey between November 2020 and February 2021, with focus on the maturity of the IVU in the financial institutions. A total of 80 banks across Europe, Middle East and South Africa participated in the survey, including 17 Nordic banks. Several Nordic banks expressed their concerns on this topic, which can be summarised as follows:
The result of this survey shows that financial institutions in the Nordics still have some way to go towards maturing their IVU to ensure that there are enough resources assigned for challenging the internal models. In addition, institutions need to complete their model inventories to ensure an effective and adequate validation of the internal models. The IVU should therefore receive higher prioritisation over the next 1-2 years for financial institutions in the Nordics to comply with the EBA paper on validation.
Given the concerns that many of the Nordic banks expressed in the Model Risk Management survey, there are areas that need to be developed to comply with the upcoming EBA Validation Handbook. Deloitte has performed several projects across EU and in the Nordics on MRM, validation, and internal audit. We are ready to support your organisation by providing Nordic and EU-wide benchmarks and best practices, conduct IRB validations, support with Model Risk Management frameworks, and provide insights regarding the roles of validation and internal audit functions.
Mira Mäkelä, Deloitte Finland
Louise Schnegell, Deloitte Denmark
Maria Englund toimii Financial Risk -palvelualueen vetäjänä Deloitte Suomessa. Hänellä on laaja kokemus riskienhallinnan ja talouden neuvonantopalveluista Euroopasta, erityisesti pääomamarkkinarahoitukseen ja pankkien luottoriskien hallintaan liittyvillä alueilla. Maria on työskennellyt sekä Irlannissa että Iso-Britanniassa Deloittella pankkiasiakkaiden lainasalkkujen, data analytiikan ja mallintamisen parissa. Briefly in English: Maria Englund is the Financial Risk Lead at Deloitte Finland. She is a seasoned leader with years of experience in providing banking and capital markets advisory services to clients across Europe. Prior to joining Deloitte Finland Maria worked in both the Irish and UK Deloitte practices. She has delivered multiple projects for European financial institutions with a focus on loan portfolio data analytics and cash flow modelling.
Mira Mäkelä työskentelee luotto- ja malliriskien hallinnan parissa Deloitten Financial Risk -tiimissä keskittyen erityisesti rahoituspalvelualan asiakkaisiin. Hänellä on kokemusta muun muassa sisäisiin malleihin (IRB) ja järjestämättömien saamisten käsittelyyn liittyvästä EU-sääntelystä, pankkien riskienhallintaan liittyvien linjausten ja menettelytapojen laatimisesta sekä niiden sääntelynmukaisuuden arvioinnista. Briefly in English: Mira works within credit risk and model risk management areas in Financial Risk team at Deloitte focusing on financial services industry clients. She has experience in EU regulation related to internal models (IRB) and non-performing exposures, establishing risk management policies and procedures in banks, and their compliance assessments.
Louise Schnegell works with credit and model risk management in Deloitte´s Financial Risk team in Denmark with a special focus on clients in the financial services. She has experience in, among other things, credit risk (IRB, IFRS 9 and Stress testing) modelling and validation, EU regulation, credit risk guidelines throughout the model lifecycle and risk appetite framework.