defi

Perspectives

Risk management and governance of digital assets

Managing the evolving risks of DeFi, CeFi, and tokenization

Responding to the evolving risks that straddle TradFi, DeFi, and CeFi: Some lessons and observations

Introduction

Despite the whirlwind of uncertainty in financial markets over the past year, as well as the failure of several key players in the digital asset industry, today blockchain and digital assets are witnessing greater levels of investment than in the two years preceding the crypto bull market of 2021 through Q2 2022. Globally, crypto curiosity has not waned. One hundred and five countries, representing more than 95% of global GDP, are exploring central bank digital currencies (CBDCs).i Moreover, proposed financial innovation regulations and policies have increased across the globe. All this could help pave the path toward greater clarity and transparency, a likely critical step for improving consumer confidence and promoting growth in the blockchain and digital asset industry.

Throughout 2022, institutional proponents of traditional finance (TradFi), including top-tier banks and fintech firms, continued to announce and roll out new cryptocurrency and digital asset services and solutions.ii Such sustained innovation could suggest that financial institutions and investors may increasingly recognize the benefits that blockchain technology and digital assets can offer beyond TradFi services and assets.

While the development of strategies to optimize the benefits of digital assets and blockchain technology continues, stakeholders also should consider how their exposure to the associated asset class aligns within their organization’s overall risk management frameworks. Although regulation is evolving, institutions should proactively engage with technology not only to help capitalize on its inherent benefits, but also to better enhance their risk management processes and mitigate the downside risk that may occur with future market dislocations.

This white paper seeks to provide an overview of different blockchain and digital asset use cases and their associated risks. It seeks to explain the different opportunities and potential risks in the crypto market, including new risks not associated with traditional financial institutions. Market participants of both centralized finance (CeFi) and decentralized finance (DeFi) may benefit from identifying and managing these risks to optimize future opportunities.

The past year indicated that there was a high degree of disparity among market participants’ expectations of the benefits of cryptocurrencies, which can be deduced from the price fluctuations of many cryptocurrencies such as bitcoin. That, as we’ll see, in part accounts for many of the disruptive market events.

Looking to the future, the likely next evolution of digitalization is the tokenization of real-world assets. That may have tangible and direct benefits for market participants through the efficiencies and opportunities offered by on-chain technology. If demand for tokenized assets increases, it may be likely that new participants will enter the market, which may further increase liquidity. Still, as with other conventional asset classes, a rapid increase in demand can overheat markets, raising the potential of another dislocation event. For sure, the lessons learned from crypto markets transcend that asset class and should also be considered in managing the future as the digital evolution continues.

Risk Management and Governance of Digital Assets

DeFi/CeFi opportunities and use cases

DeFi

Crypto-native and technology companies often support the ecosystem through the creation of decentralized protocols and the development of new digital asset use cases. Many may replicate or replace TradFi services, such as borrowing, lending, and trading through a direct, peer-to-peer environment, created through decentralized applications (dApps). Additionally, access to the open-source code within DeFi protocols may allow for a composable infrastructure. There, users can innovate, create financial services, build financial instruments, and tokenize physical assets. This trend may put pressure on TradFi to adapt and consider whether or not to incorporate digital asset offerings and on-chain transactions among their current product offerings to potentially help meet customer demands.

CeFi

CeFi uses blockchain technology to allow market participants to access and transact digital assets through a centralized exchange. CeFi is an emerging industry that aims to offer market participants many of the benefits of DeFi but with the security and risk management aspects of TradFi. Retail and traditional financial institutions may use CeFi as a gateway to access opportunities in the digital asset ecosystem such as crypto trading, lending, staking, and asset tokenization. As we will explore shortly, these opportunities may also present risks for market participants, risks that require active monitoring and management to mitigate the associated downside exposure.

TradFi institutions should consider and weigh the pros and cons: Should we include digital assets as a product offering? Is it better to develop the blockchain infrastructure in-house or does partnering with a crypto service provider offer greater benefits? There appears to be a trend of convergence between TradFi and “crypto natives” (i.e., startups primarily offering blockchain and/or digital asset services/solutions), whereby emerging technology and innovative solutions are integrated with traditional financial services. If true, that may pave the way for financial services transformation. There have also been instances of traditional institutions, investment banks, and dealers partnering with crypto natives to offer and develop crypto products, such as custody solutions or providing customers access to crypto trading products.iii

Use cases

Over the past few years, we have seen organizations reinvent the ways in which digital assets can replicate and enhance TradFi services across DeFi/CeFi. There are certain use cases that illustrate how DeFi and CeFi are impacting the financial services landscape. Nevertheless, these use cases may entail certain risks for market participants. Some common use cases are summarized below:

  • Payments–Blockchain technology may enable 24/7 money movements, thereby helping solve cross-border challenges, as well as creating a direct peer-to-peer network—all to help facilitate a more efficient payment process.
  • Market making, investing, and lending–Blockchain technology and smart contracts can allow for automation through self-execution of processes previously dependent on human involvement. This could promote several benefits, including more efficient collateral management and settlement of contractual payments.
  • Tokenized assets–Tokenized assets can be created using smart contracts. That could provide investors with the opportunity for a broader spectrum of customized products to fit their investment or hedging profile, all the while reaping the benefits that on-chain technology offers.

Increased regulatory focus

Given the growth of digital assets and recent market events, Sovereigns around the globe are prioritizing the need for participation and regulation. President Biden signed an executive order on March 9, 2022, to establish a national policy for digital assets. Among its priorities are consumer and investor protection, financial stability, financial inclusion, responsible innovation, illicit finance, and US leadership in the global financial system.iv According to the White House, the significant rise in the popularity of digital assets creates an important opportunity for the United States to play a leading role in global governance consistent with the values of democracy and US global competitiveness.

Additionally, more than 100 countries, including the United States, are exploring or piloting CBDCs, which are digital forms of sovereign currencies.v

Increased regulatory focus in this space has resulted not only from the growth of digital assets, but also from the associated volatility to which market participants have been exposed during the recent “crypto winter.” The consequent failures and bankruptcies have also highlighted the risk for investors.

Risk landscape

The advancements of cryptography have been proven fundamental to the security and trust environment that blockchain technology offers. However, the recent volatility of digital assets points to the need for greater transparency and could remind us that market participants are not absolved from applying the core principles of risk. In fact, elements of systemic and idiosyncratic risks that have been present in TradFi surfaced in the digital asset arena in the first half of 2022. The result? Several prominent bankruptcies and billions of dollars of lost investor value.vi

The crypto winter of 2022 may have taught us that, while the digital revolution advances, we aren’t likely to escape the gravitational pull of human behavior. Although there are significant opportunities for outsized returns, market participants are not immune to risks long familiar to participants in conventional financial markets.
 

  • Expand all
  • Collapse All

It’s no secret that financial market participants could use leverage as a method to amplify profits. In bull markets, “team volatility and leverage” are sometimes considered best friends with “above-market returns,” and risks can effectively (or rather temporarily) be hedged using similar, but not identical, and often simpler, instruments. For example, market participants may often hedge the risks associated with complex derivative instruments by decomposing the risk elements into their core Greek elements. Then they use more liquid and simpler instruments to hedge the underlying risks (e.g., volatility). The beauty of this risk management strategy is that participants can earn bid/offer spreads by making markets in more complex derivatives while cheaply hedging the underlying risks.

This setup may work well until it does not. At which point “team volatility and leverage” abandon their once beloved friend “above-market returns.” A market dislocation tail event, often triggered by a sharp decline in investor demand, is generally rare; however, when it does occur, the previous combination of volatility and leverage can often take market participants by surprise and lead to significant turmoil and losses.

Effectively managing tail risks and weighing proper risk considerations as part of the development of new products—which can allow for further exponential growth—can require several steps that market participants may want to consider as part of their process.

  1. Recognize and understand relevant risks.
  2. Establish proper tone at the top, corporate governance, processes and controls to effectively manage the risks, and many possibilities of future market conditions.
  3. Leverage innovative blockchain technology to elevate the risk management strategy beyond what has been afforded by participants in TradFi.
  4. Integrate the enhanced risk management process with the new product development strategy to make informed risk-reward decisions and manage systematic and idiosyncratic risks throughout the economic cycle, including tail risk events.

During the first half of 2022, there were several examples of volatility, leverage, basis, and other risks impacting market participants. We will tackle a few of those risks to highlight their relevance from a risk management perspective.

Lack of appropriate corporate governance: While the details attending recent industry failures and legal proceedings are still unfolding, it appears that significant corporate governance inadequacies may be responsible for enabling much of the breakdown that occurred at institutions such as FTX. Appropriate corporate governance, sound internal controls, and well-developed risk management programs are crucial to helping ensure a sustainable business. Those core principles should not change in a digital environment. In fact, they may become more important given the relative infancy of the industry.

Blockchain and digital assets are not the first industry where bad actors circumvent or fail to implement appropriate corporate governance measures. This behavior transcends cultures, industries, and technologies. Investors and stakeholders of CeFi/DeFi may consider keeping this in mind when evaluating whether a business model is too good to be true. After all, there is “no free lunch” for investors, even in the digital age.

Volatility and leverage: Best friends or foes? The price collapse of certain stablecoins in 2022 demonstrated certain risks associated with an asset class whose stability depends on market participants’ demand and willingness to maintain the $1 peg. Once those conditions started to dislocate, the once stable asset type was suddenly exposed to significant downside volatility. The false sense of stability assigned to such asset class may have also resulted in market participants taking on significant exposure and concentration risk. This exposure resulted in outsized losses. Not only for those participants who had direct exposure (first order), but also for those participants who had DeFi lending arrangements with such participants (second order). This highlighted the fact that counterparty risk continues to remain a topic of concern as markets move from TradFi to DeFi and CeFi, because technological changes alone likely do not mitigate the risk.

The interconnectivity of the risk among participants in the digital asset ecosystem shares certain similarities to the risks that were present during the 2008 credit crisis—specifically, if leverage continues to be a factor that can lead to outsized losses for market participants across the ecosystem. Although collateral can be used to mitigate counterparty risk, it does not eliminate the need to carefully manage the associated risk. The false sense of security that collateralized transactions may provide could be seen in TradFi during the 2021 Archegos default. This credit event resulted in financial institutions around the globe incurring billions of dollars of losses from their concentrated exposure to equity returns in the form of fully collateralized equity-swap derivatives.

Certain DeFi lending arrangements utilize built-in smart contract protocols to terminate the arrangement, if and when the value of collateral falls below a pre-specified level relative to the loan amount.vii Such protocols are designed to help further reduce counterparty risk. But they can also result in a systemic counterparty risk event should the underlying borrower have concentrated exposure to multiple lenders using the same collateral across these lending arrangements. The risk may be further elevated by another risk concept referred to as “wrong-way risk.” In that instance, the borrower’s ability to pay back the loan is correlated with the performance of the underlying collateral. Once the collateral decreases, the smart contract protocols trigger liquidation notifications. And if the concentrated exposure is sufficiently significant, such an action could then put further downward pressure on the price of the collateral as lenders sell the collateral to unwind their positions.

And then there is basis risk: Although this paper cannot provide any pricing advice or predictions of future performance, Lido’s staked Ether (stETH) is an example of how basis risk can impact the digital asset ecosystem, with resulting significant losses in collateralized transactions.

Staked Ether (stETH) represents a liquidity token acquired in anticipation of Ethereum's shift to a proof-of-stake consensus protocol in late 2022. Market participants generally expect that each stETH token will be redeemed for one ETH. As such, there is reason for market participants to envision that the price for these two tokens should move in tandem. Given the expectation that the stETH/ETH price ratio should be close to 1, stETH was used as collateral when market participants borrowed ETH.viii Keep in mind that because of the uncertainty associated with the timing (current expectation is first half of 2023) of when stETH can be redeemed for ETH (as well as differences in underlying liquidity) stETH should theoretically be priced below ETH. Consequently, it could be false to assume from a valuation perspective that the valuation of stETH should be equivalent to that of ETH.

Subsequent to the luna/terraUSD collapse, the price of stETH began to decouple from the ETH price. And, as the underlying lending arrangements were no longer fully collateralized, that decoupling triggered selling pressure as lenders moved to mitigate losses. This sell-off placed further downward pressure on the price of stETH. The result? A ratio of 0.9338 on June 18, 2022, in contrast to a ratio that consistently remained above 0.99 from January 1 to May 7, 2022.ix

Although the decoupling may not seem significant at first glance, many institutions had concentrated exposure to stETH. Consequently, their challenges were exacerbated since stETH cannot be exchanged for ETH until the “Merge” (i.e., the convergence of the original Ethereum Mainnet with a separate proof-of-stake blockchain called the Beacon Chainx ) has concluded and the proof-of-stake model is fully implemented. The downward pressure on stETH, coupled with the associated basis risk, resulted in a liquidity crunch that yielded significant losses for market participants.

Cybercriminals seem to be keeping up with (or maybe even outpacing) technology advancements: The examples of luna/terraUSD and stETH/ETH do not present risks that are unique to digital assets. There have been countless examples of similar risks in TradFi, whose operational risks have been exploited through numerous fraud schemes. The advancement of blockchain technology helps mitigate some of these operational risks. But as cybercriminals continue to evolve with the overall technological developments, blockchain technology is not immune to the payment hacks that TradFi has faced.

Cryptography is a key element to the security of blockchain ledgers. Yet, the application layer, which represents the user-oriented interface for the blockchain, has been subject to cyber risk incidents. Just as cyberattackers compromised a payment messaging system to steal $81 million from the Bangladesh central bank, fictitious transaction approvals generated after gaining access to BadgerDAO’s user-interface application enabled cyber thieves to make off with $120 million in 2021.

Decentralized protocol risk: Although there are many advantages associated with DeFi, the details of which are beyond the scope of this paper, the governance issues raised by a decentralized protocol can create a new and nuanced risk. By its very nature, there is no central body to confirm the completeness and accuracy of the information on the decentralized platforms. So how do customers and other external stakeholders obtain assurance about the information presented? DeFi participants should be mindful of this scope risk. That means confirming that proper processes and controls are in place to evidence the reliability of the information within the DeFi environment.

Here’s an example that can help underscore the need to align the blockchain protocol with proper and approved licensing requirements for DeFi entities. Recently the Commodity Futures Trading Commission (CFTC) issued an order against Ooki DAO alleging that, through its software protocol, Ooki DAO illegally offered leveraged and margined retail commodity transactions in digital assets. Moreover, it engaged in activities that only registered futures commission merchants can perform. And it failed to adopt a customer identification program as part of a compliance with the Bank Secrecy Act, which is a requirement for futures commission merchants.xi

By proactively implementing appropriate processes and controls to help mitigate protocol risks, market participants may be more likely to capture growth opportunities that can come from simply meeting external third-party requirements (e.g., regulators and auditors).

Given the nature of DeFi—and specifically permissionless blockchains, where anyone can participate as long as they meet certain technological requirements—know-your-customer (KYC) verification can be challenging. And that challenge increases the overall anti-money laundering (AML) risk, a traditional area of focus for TradFi.

Many crypto exchanges aim to be KYC compliant, and permissioned blockchains can allow for the monitoring of suspicious activity. Comprehensive controls and monitoring of AML risk within DeFi and CeFi are partnerships across the ecosystem that may be vital for future growth.

However, it could be misleading to approach AML risk within DeFi and CeFi as though replicating the methods of TradFi was sufficient. Instead, the technological enhancement embedded within blockchain technology can be leveraged to monitor, detect, and prevent AML activity. Further, the traceability and immutability proper to blockchain technology can help mitigate many of the AML risks that have historically challenged TradFi.

Getting prepared for the future: Governance, processes, and controls
Milton Friedman, the Nobel laureate economist, famously coined the expression, “There is no such thing as a free lunch.” That continues to be an evergreen statement in the digital ecosystem. While market participants cannot eliminate risk, they can better understand, manage, and control relevant risks with the implementation of proper governance, processes, and controls.

The Committee of Sponsoring Organizations of the Treadway Commission (COSO) has established a framework for effective internal controls built on 17 core principles. This framework has served US public companies as they responded to the Sarbanes-Oxley Act’s requirement for controls over financial reporting.xii Such a framework can help support the efforts of DeFi/CeFi companies in designing the proper corporate governance, processes, and controls that undergird an effective risk management program. Central to the COSO framework is the need to scope out a clear and defined risk assessment. That can help ensure that the business’s activities align with the inherent risk appetite of its stakeholders, including investors and future regulators.

Although the COSO framework provides a guidepost for the foundation of risk management, there’s more to it than that. Market participants should consider supplementing such a framework with tailored processes and controls that assess their exposure to various individual and joint risks and in different market scenarios. In turn, those processes and controls may enable DeFi/CeFi participants and stakeholders to:

  • Optimize the alignment of capitalizing on market demand for new products.
  • Maximize the risk/return profile.
  • Establish proper controls to evaluate and manage the associated risks through different market conditions, including tail events.


In the heavily regulated banking industry, various regulators have issued risk frameworks. The Comprehensive Capital Analysis and Review (CCAR) and Federal Reserve Supervision and Regulation Letter No. 11-7: Guidance on Model Risk Management (“SR 11-7”) provided by the Federal Reserve are two examples that continue to serve as a blueprint for the development of the risk management departments in the largest US banks.xiii Although these regulations were not intended for DeFi/CeFi market participants or digital assets, the principals set out in these two frameworks are relevant to DeFi/CeFi participants since they furnish useful insights about the potential expectations of regulators. In addition, they provide guidance on leading practices for designing processes and controls to stress test a market participant’s resilience in various market conditions. That’s done by applying risk management scenarios, as well as by evaluating the robustness and accuracy of modeling calculations tied to the development of digital assets and the application of blockchain technology.

Needless to say, digital players should recognize any commonalities and differences with TradFi and when and how to tailor risk management processes to align with the unique aspects of digital.

The difference that could make the difference – Incorporating tailored and relevant risk management to the development of new products
Successful DeFi/CeFi participants can recognize the importance of properly evaluating the full spectrum of risk considerations including tail risk. That can be important when developing new products and customizing the smart contract protocols in order to mitigate against risk in the 95th percentile of event distributions. It can also be important to consider the necessary protocols to appropriately manage risk during 5th percentile tail events.

All that requires a careful understanding of anticipated behavior by market participants in normal and tail risk environments. Add to that recognition of the fact that technology alone cannot eliminate all risks. Nevertheless, blockchain technology can offer numerous advantages.

For a moment, let’s consider the TradFi losses associated with Archegos. One of the main drivers behind the significant losses suffered by the banks was the lack of transparency around Archegos’s concentrated exposure to the underlying equities associated with the equity-swap derivatives that it had arranged with the various financial institutions. Although each bank may have been aware of its own exposure to the underlying equities and their overall Archegos exposure, it may have been harder for them to assess the concentrated exposure of such equities across all banks that had derivative contracts with Archegos. Blockchain technology offers a level of transparency that can help rectify such a situation. It enables market participants so inclined to analyze and evaluate the potential for similar concentrated exposures. Still, one does have to establish processes and controls to analyze the information within the blockchain and evaluate relevant changes in order to appropriately manage such risks. It doesn’t happen on its own.

Conclusion

Despite continued uncertainty, blockchain technology and digital assets are shaping up to be a transformational force in charting the future of financial markets. That fact notwithstanding, relevant risks cannot be ignored as the ecosystem continues to evolve. The existing regulatory frameworks used to address and mitigate risk in the TradFi regulatory environment provide a gateway for market participants who want to prepare for future regulation and manage the risks attendant to the DeFi and CeFi environment. These risks should be tackled head-on, in a thoughtful and comprehensive manner. And if executed appropriately, market participants may well have a parachute that allows for a safe landing during the next tail risk event … which is just one cycle away.

Contact us

Our Blockchain & Digital Assets leaders are ready to help your business trailblaze in this space – with a multi-lens perspective that provides clarity through the complexity. Reach out to ask a question, start a conversation, and select “yes” below to subscribe for the newest insights and reports about Blockchain and Digital Assets.

 
 
 
 
 
 
 
  Yes         No

About Blockchain & Digital Assets at Deloitte

At Deloitte, our people work globally with clients, regulators, and policymakers to understand how blockchain and digital assets are changing the face of business and government today. New ecosystems are developing blockchain-based infrastructure and solutions to create innovative business models and disrupt traditional ones. This is occurring in virtually every industry and in most jurisdictions globally. Our deep business acumen and global industry-leading Audit & Assurance, Consulting, Tax, and Risk and Financial Advisory services help organizations across industries achieve their various blockchain aspirations. Learn more at deloitte.com/us/blockchainanddigitalassets.

Authors

Alex Lakhanpal
CFA, Audit & Assurance Partner
Deloitte & Touche LLP
alakhanpal@deloitte.com
 

Erica Lacerenza
Audit & Assurance Managing Director
Deloitte & Touche LLP
erlacerenza@deloitte.com

Contributors

Rob Massey
Tax Partner
Deloitte Tax LLP

Tim Davis
Advisory Principal
Deloitte & Touche LLP

Brian Hansen
Audit & Assurance Partner
Deloitte & Touche LLP

Steven Shtaynberger
Advisory Sr. Consultant
Deloitte & Touche LLP

Seth Connors
Advisory Sr. Manager
Deloitte & Touche LLP

C.J. Burke
Advisory Sr. Consultant
Deloitte & Touche LLP

 

This publication contains general information only and Deloitte is not, by means of this publication, rendering accounting, business, financial, investment, legal, tax, or other professional advice or services. This publication is not a substitute for such professional advice or services, nor should it be used as a basis for any decision or action that may affect your business. Before making any decision or taking any action that may affect your business, you should consult a qualified professional adviser.

Deloitte shall not be responsible for any loss sustained by any person who relies on this publication.

About Deloitte
Deloitte refers to one or more of Deloitte Touche Tohmatsu Limited, a UK private company limited by guarantee (“DTTL”), its network of member firms, and their related entities. DTTL and each of its member firms are legally separate and independent entities. DTTL (also referred to as “Deloitte Global”) does not provide services to clients. In the United States, Deloitte refers to one or more of the US member firms of DTTL, their related entities that operate using the “Deloitte” name in the United States and their respective affiliates. Certain services may not be available to attest clients under the rules and regulations of public accounting. Please see www.deloitte.com/about to learn more about our global network of member firms.

Copyright © 2023 Deloitte Development LLC. All rights reserved.

Endnotes

Ananya Kumar and Josh Lipsky, “Central banks are embracing digital currencies. Will the US lead or follow?,” New Atlanticist, June 2, 2022.
ii Goldman Sachs, “The future of digital assets,” accessed February 27, 2023; Ian Allison and Coindesk, “JPMorgan on its crypto plans: ‘The overall goal is to bring these trillions of dollars of assets into DeFi’,” Fortune, June 12, 2022; Ian Allison, “JPMorgan wants to bring trillions of dollars of tokenized assets to DeFi,” Coindesk, June 11, 2022; Samuel Indyk, “BNY Mellon says investors ‘absolutely interested’ in digital assets,” Reuters, February 9, 2023.
iii Berivan Demir, “A match made in crypto: Partnerships in a new age of finance,” Fintechly, July 21, 2022; Hubbis, “Fintonia secures CMS license upgrade, with mainstream adoption of digital assets driving greater demand for partnerships from traditional and crypto-native institutions,” February 9, 2023; David L. Portilla et al., “Blockchain in the banking sector: A review of the landscape and opportunities,” Harvard Law School Forum on Corporate Governance, January 28, 2022.
iv The White House, “Executive Order on Ensuring Responsible Development of Digital Assets,” March 9, 2022; Deloitte, “New layer to crypto policy emerges with digital assets executive order,” 2022.
v Kevin Helms, “105 countries are exploring central bank digital currencies, CBDC Tracker shows,” Bitcoin.com, June 6, 2022.
vi David Yaffe-Bellany and Erin Griffith, “How a trash-talking crypto founder caused a $40 billion crash,” New York Times, updated May 20, 2022.
vii International Swaps and Derivatives Association (ISDA), “Legal guidelines for smart derivatives contracts: Collateral,” September 12, 2019; Moody’s Analytics, “ISDA guide on collateral management under smart derivatives contracts,” September 12, 2019.
viii CoinGecko, “Lido Staked Ether,” accessed February 27, 2023; Ryan Browne, “What you need to know about staked ether, the token at the center of crypto’s liquidity crisis,” CNBC, June 20, 2022.
ix CoinGecko, “Cryptocurrency prices by market cap,” accessed February 27, 2023.
x Rob Massey et al., The Ethereum upgrade: Musing about the Merge (While keeping tax and accounting considerations in mind), Deloitte, October 2022.
xi Commodity Futures Trading Commission (CFTC), “CFTC imposes $250,000 penalty against bZeroX, LLC and its founders and charges successor Ooki DAO for offering illegal, off-exchange digital-asset trading, registration violations, and failing to comply with Bank Secrecy Act,” press release no. 8590-22, September 22, 2022.
xii Committee of Sponsoring Organizations of the Treadway Commission (COSO), COSO home page, accessed February 27, 2023.
xiii Board of the Governors of the Federal Reserve System (FRB), “SR 11-7: Guidance on Model Risk Management,” April 4, 2011.