Skip to content

FRM Exam Part II · Case Study: Model Risk and Model Validation

Sources and Types of Model Risk in Banking

Updated 11 October 2026 · Fact-checked

Model risk is the risk of adverse consequences, such as financial loss, bad decisions or reputational damage, from errors in a model or from its incorrect use. It arises from flawed design and assumptions, bad data, faulty implementation and misuse. To answer exam questions, find where in the model's life the failure occurred.

Understand Sources and Types of Model Risk

A model turns inputs and assumptions into estimates a firm uses to decide things: price a trade, set a limit, hold capital, approve a loan. Model risk is the chance that the output is wrong or misused, and that the firm suffers because of it. The US supervisory guidance SR 11-7 frames it this way, and GARP uses that framing.

Model risk comes from two broad places. The first is fundamental errors: the model is wrong at the design or build stage. The second is incorrect or inappropriate use: the model may be fine, but it is applied outside the purpose or conditions it was built for.

Within fundamental errors, think in layers. Assumption errors: the theory is wrong or too simple, for example assuming normal returns, constant volatility or stable correlations. Data errors: inputs are missing, stale, biased, mis-mapped or from a calm period that does not represent stress. Implementation errors: the maths is right but the code, spreadsheet, formula link or system feed is wrong. Calibration and estimation errors: parameters are fitted badly or on a short window.

Misuse includes using a model for a new product or market without revalidation, ignoring its stated limits, overriding outputs without a record, or relying on one output without challenge. Weak governance, such as no independent validation, no inventory and poor documentation, lets all of these go undetected.

It matters because models drive capital, pricing, hedging and risk limits. A flawed model can understate risk, cause losses, trigger regulatory action or add capital. Model risk is not the same as operational risk, though model errors that come from coding, system or process failure can overlap with operational risk. It is managed through validation, governance and conservatism, not removed.

Key formulas to remember

Definition of model risk (SR 11-7 style)
Model risk = risk of adverse consequences from decisions based on incorrect or misused model outputs
Consequences include financial loss, poor business and strategic decisions, and damage to reputation.
Two main sources
Model risk = fundamental errors + incorrect or inappropriate use
Fundamental errors cover assumptions, data, implementation and calibration. Use covers outside-scope application and poor oversight.
Risk grows with
Higher model risk ← greater complexity, greater uncertainty of inputs, broader use, larger potential impact
This is a general principle, not a numerical formula. Use it to justify more intensive validation.

How to solve Sources and Types of Model Risk questions

Use this sequence for any scenario question asking about the cause, type or response to model risk.

  1. 1Identify the model and its purpose: pricing, VaR, credit scoring, capital or stress testing.
  2. 2Locate the failure in the model lifecycle: design and assumptions, data inputs, implementation and code, calibration, or use.
  3. 3Decide whether the model itself was wrong (fundamental error) or the application was wrong (misuse).
  4. 4Match the symptom to a type: unrealistic assumption, stale or biased data, coding or formula error, or use outside intended scope.
  5. 5Ask whether governance failed too: no independent validation, no limits on use, no documentation, no challenge.
  6. 6Choose the answer that names the root cause, not just the visible loss.
  7. 7State the fix: revalidate, correct data or code, add limits or overlays, or retire the model.

Quickest way: Four-bucket sort

When to use it: Use when an MCQ describes a failure and asks for the source of model risk.

  1. Read the scenario and ask: was the theory wrong, the data wrong, the code wrong, or the use wrong?
  2. Assumptions: model ignores fat tails, jumps or changing correlation.
  3. Data: stale, missing, mis-mapped or unrepresentative inputs.
  4. Implementation: spreadsheet, formula, coding or system-feed error.
  5. Misuse: right model, wrong purpose or context. Pick the bucket whose wording best matches.

Common mistakes in Sources and Types of Model Risk

  • Calling every model failure an assumption error.

    Assumptions are the best-known source, so students default to them.

    Fix: Check whether the theory is sound but the data or code is wrong. Pick the bucket that matches the stated cause.

  • Treating a good model used wrongly as a fundamental error.

    Students focus on the loss, not on whether the model was applied within its design scope.

    Fix: If the model works for its intended purpose but was applied to a new product or market, the source is misuse.

  • Saying model risk can be eliminated by validation.

    Validation sounds like a complete cure.

    Fix: Say it is reduced and managed. All models are simplifications, so some risk always remains.

  • Equating model risk with operational risk.

    Both involve errors and internal failures.

    Fix: Model risk is about wrong or misused model outputs. Operational risk is the broader loss from failed processes, people, systems or events. Model errors from coding or process failure can overlap with operational risk.

  • Ignoring governance as a source.

    Students think only of the maths.

    Fix: Remember missing inventory, no independent validation and weak documentation allow errors to persist.

Worked examples

Example 1

A bank's VaR model uses two years of calm market data to estimate volatility. In a stress period, losses far exceed VaR. The code and the VaR methodology were verified as correct. What is the main source of model risk?

Show the solution
  1. The code was verified, so implementation is not the cause.
  2. The methodology is correct, so it is not a use problem either.
  3. The inputs came from a calm window that does not represent stress.
  4. This makes the data unrepresentative, with an estimation window that understates risk.

Answer: Data error: an unrepresentative, calm-period sample that understated volatility.

Example 2

A bank validated a model for pricing vanilla USD interest rate swaps. The desk now uses it, unchanged, to price exotic callable structures and reports large mispricing. Which source of model risk best explains this?

Show the solution
  1. The model was valid for vanilla swaps, so the design is not necessarily wrong for its original purpose.
  2. The failure arises because it was applied to products it was not built or validated for.
  3. This is use outside the intended scope, a case of incorrect or inappropriate use.
  4. The fix is to revalidate for the new product or build a suitable model.

Answer: Misuse: applying a validated model outside its intended scope without revalidation.

Exam tips

  • Scenario questions usually hide one clue word: stale, spreadsheet, outside scope, assumed normal. Match it to the source.
  • Distinguish fundamental errors from misuse. Many wrong options swap the two.
  • Expect governance links: validation independence, inventory and documentation are common answers.
  • Do not say model risk is eliminated. Correct options say reduced or managed.
  • Know that SR 11-7 is the reference framework GARP uses for model risk definitions.

Practice questions from Case Study: Model Risk and Model Validation

Sources and Types of Model Risk: frequently asked questions

What is model risk in banking?

It is the risk of loss or poor decisions because a model is wrong or used incorrectly. It can come from flawed assumptions, bad data, implementation errors or misuse. Firms manage it through governance and independent validation.

What are the main sources of model risk?

Assumptions that do not hold, poor or unrepresentative data, errors in implementation or coding, bad calibration, and use of a model outside its intended purpose. Weak governance lets these go unnoticed.

What is the difference between model risk and operational risk?

Model risk is about wrong or misused model outputs driving decisions. Operational risk is the wider risk of loss from failed processes, people, systems or external events. They overlap when a model error comes from a coding or process failure.

Can model risk be removed completely?

No. Models simplify reality, so some error always remains. Firms reduce it through validation, challenge, limits, conservative overlays and ongoing monitoring.