Skip to content

FRM Part II · FRM Exam Part II

Supervisory Guidance on Model Risk Management for FRM Part II

Supervisory Guidance on Model Risk Management is the US supervisory guidance (SR 11-7) on how banks should control the risk of loss from wrong or misused models. To solve questions, identify the stage involved (development, validation, governance or vendor use) and apply the guidance's expectation for that stage, including effective challenge.

What this chapter covers

This chapter covers SR 11-7, the supervisory guidance on model risk management issued by the US Federal Reserve and the OCC. It defines model risk as the potential for adverse consequences from decisions based on incorrect or misused model outputs. It then sets out what a bank should do across the model lifecycle: develop and implement, validate, govern, and handle vendor models.

The guidance names two root causes of model risk. The first is fundamental errors: the model may have flaws in design, data, assumptions or implementation, and so produce inaccurate outputs. The second is incorrect or inappropriate use: a sound model applied outside the setting it was built for. Keep both in mind, because many exam questions test which of the two a scenario shows.

The chapter links to the whole paper. Market risk, credit risk, liquidity and investment management all rely on models such as VaR, rating and PD models, and pricing models. Questions in those topics often hide a model risk issue: a backtest failure, stale data, or a vendor black box. Here you learn the control framework that sits over all of them. Questions are usually short scenarios asking what a bank should do, or which action best fits the guidance.

This chapter is conceptual, so marks come from reading a scenario and choosing the action that matches the guidance. There are few calculations, which makes it a good place to secure points with precise recall of terms such as effective challenge, outcomes analysis and ongoing monitoring. The same ideas also help you in market risk, credit risk and operational risk questions, where model weaknesses are a common theme. Weak command of the vocabulary leads to errors between answer choices that look similar.

Supervisory Guidance on Model Risk Management: topics in the order to study them

  1. 1Model Risk Definition and Sources (SR 11-7)Start here because the definition and the two sources of model risk frame every later topic.
  2. 2Model Development, Implementation and UseLearn how a sound model is built and used before you study how it is tested.
  3. 3Model Validation and Effective ChallengeValidation checks the development work, so it follows it, and effective challenge is the core idea of the chapter.
  4. 4Governance, Policies and ControlsGovernance ties development and validation together through roles, policies, inventory and documentation.
  5. 5Vendor Models and Model Risk AggregationThis comes last because it applies the earlier controls to outside models and to the bank-wide view of risk.

How to prepare Supervisory Guidance on Model Risk Management

Treat this as a framework chapter. You are learning who does what at each stage and why, not memorising a list.

  1. Write the definition of model risk and the two sources in your own words, then test yourself on scenarios and label each as a fundamental error or misuse.
  2. Map the model lifecycle on one page: development, implementation, use, validation, monitoring, governance. Under each stage, note the key expectations.
  3. Learn the three core elements of validation: evaluation of conceptual soundness, ongoing monitoring, and outcomes analysis. Be able to say what each one checks.
  4. Define effective challenge: critical analysis by objective, informed people with the competence, influence and incentives to challenge. Practise spotting where it fails in a scenario.
  5. Study governance roles: board and senior management responsibilities, model inventory, documentation and policies. Note who sets direction and who carries out tasks.
  6. Compare in-house and vendor models, and note that vendor models still need validation and documentation. Then think about how model risk is aggregated across the bank.
  7. Finish with timed scenario questions. After each, explain why the wrong options fail against the guidance.

Common mistakes in Supervisory Guidance on Model Risk Management

  • Treating model risk as only a calculation error.

    Fix: Always check both sources. A correct model used for the wrong purpose or population is still model risk.

  • Confusing validation with development testing.

    Fix: Remember that validation is an independent review that includes conceptual soundness, monitoring and outcomes analysis. Developer testing is only one input.

  • Mixing up the elements of validation.

    Fix: Tie each to its element: soundness is about design and theory, monitoring is about continued performance, and outcomes analysis compares results with actuals.

  • Defining effective challenge as just independence.

    Fix: Recall all three attributes: competence, influence and incentives, within an independent process.

  • Assuming vendor models need less control.

    Fix: The bank still owns the risk. It should validate, document its understanding and monitor performance as it would for an in-house model.

  • Giving the board a hands-on technical role.

    Fix: The board and senior management set expectations and oversee, while qualified staff carry out development, validation and monitoring.

Last-day revision: Supervisory Guidance on Model Risk Management

  • Model risk is the potential for adverse consequences from decisions based on incorrect or misused model outputs.
  • Two sources: fundamental errors in the model, and incorrect or inappropriate use.
  • A model is a quantitative method that turns input data into quantitative estimates, using statistical, economic, financial or mathematical theories.
  • Model risk rises with greater complexity, more uncertainty, broader use and larger potential impact.
  • Validation has three core elements: conceptual soundness, ongoing monitoring, and outcomes analysis.
  • Backtesting compares model forecasts with actual results and is part of outcomes analysis.
  • Effective challenge needs competence, influence and incentives, and independence from model development.
  • Validation should be done by staff independent of development and use, with enough standing to challenge.
  • The board and senior management set direction and oversee model risk; they do not build the models.
  • A model inventory and clear documentation are core governance controls.
  • Vendor models still need validation, and the bank must understand their limits even when the code is proprietary.
  • Limits and sound judgment are tools to manage model risk, and models should be used within their intended purpose.

Supervisory Guidance on Model Risk Management practice questions

Supervisory Guidance on Model Risk Management in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Supervisory Guidance on Model Risk Management: frequently asked questions

What is SR 11-7 in FRM Part II?

SR 11-7 is the US supervisory guidance on model risk management. It defines model risk and sets out expectations for development, validation, governance and vendor models. FRM Part II tests its concepts through short scenarios.

Is this chapter calculation heavy?

No. It is mainly conceptual, so you need to know the definitions and the expected actions at each stage. Practice with scenario questions rather than formulas.

What is effective challenge?

It is critical analysis of a model by objective, informed people who can identify its limits and assumptions. They need competence, influence and incentives to act, and they should be independent of model development.

How long should I spend on this chapter?

Because the content is compact and conceptual, it can be covered faster than quantitative chapters. Spend enough time to learn the terms precisely and practise scenario questions until you can explain each wrong option.