CAIIB Paper 2 Module B Quiz 7

Model risk can arise from conceptual errors, unsuitable assumptions, poor data, implementation defects, misuse or inappropriate interpretation. It is managed through governance, validation, controls and monitoring.

Model governance establishes ownership, documentation, approval, validation, change control, performance monitoring and limitations. Independent challenge reduces the chance that defects remain undetected.

Models and risk reports are only as reliable as their inputs. Data quality controls should address completeness, accuracy, timeliness, consistency, lineage and reconciliation.

Overrides may sometimes be necessary, but should have a clear rationale, authorised approval, audit trail and monitoring to prevent bias, manipulation or recurring model defects.

Governance ensures stress scenarios reflect material vulnerabilities, assumptions are credible and challenged, results are escalated, and management actions are considered. Stress tests should influence limits, capital and contingency plans.

Reverse stress testing starts with a defined failure or unviability outcome and identifies combinations of events that could cause it. It can reveal vulnerabilities not obvious from standard scenarios.

Sensitivity analysis often changes one factor or a limited set of inputs. Scenario analysis evaluates a coherent set of changes across factors, potentially capturing interactions and second-round effects.

Weak aggregation can leave management without a complete, timely view of concentrations and exposures. Strong governance, common definitions, data architecture and controls support reliable reporting.

Risk metrics depend on scope, data, assumptions and models. Explaining limitations helps decision-makers interpret results properly and prevents overreliance on a single number.

A dashboard presents key risk information in an accessible form, enabling management to see trends, concentrations, breaches and emerging issues. It should support drill-down and not obscure material detail.

Breach procedures should identify the cause, exposure, duration and impact, notify the appropriate authority and implement corrective action or an authorised exception in accordance with policy.

Historical data is essential but insufficient. Forward-looking indicators, scenarios and projections help management prepare for changing conditions and take preventive action.

Internal audit independently assesses the effectiveness of governance, risk management and controls. It should remain independent from the activities it audits and does not assume management’s risk ownership.

Material changes should undergo controlled development, testing, impact assessment, appropriate independent validation and approval before use. Version control and rollback plans support safe deployment.

A common taxonomy supports consistent identification, aggregation, ownership and reporting across business units. Definitions should be clear enough to reduce inconsistent classification.

Models simplify reality and depend on assumptions and data. Effective use combines sound methodology, validation, monitoring, judgement and awareness of limitations.

Risk-adjusted performance measures evaluate returns relative to risk exposure or capital consumed, helping compare business lines more meaningfully than raw profit alone.

Common definitions and taxonomies make reports comparable across units, support aggregation and clarify ownership. Inconsistent terminology can hide concentrations or create misleading totals.

Stress results should feed into decisions and remediation. Management may adjust exposures, limits, capital or liquidity buffers, hedges, contingency plans or business strategy depending on the vulnerability.

Spreadsheet controls include controlled access, protected formulas, documented logic, version control, independent review, testing and reconciliation to source systems. These reduce errors and unauthorised changes.