Skip to content

FRM Part II · FRM Exam Part II · Supervisory Guidance on Model Risk Management

A bank wishes to use a vendor-supplied credit scoring model whose code is proprietary and cannot be shared. The model owner proposes skipping validation because the vendor certifies it is accurate. Which response best aligns with supervisory guidance?

The bank should still validate the vendor model, using documentation, benchmarking, sensitivity and outcomes analysis, and ongoing monitoring, and should require adequate information from the vendor. Vendor certification does not replace the bank's own assessment, and proprietary code does not exempt the model from governance.

  1. AValidate it anyway, using available documentation, benchmarking, outcomes analysis and ongoing monitoring, and require the vendor to give sufficient information about design and limitsCorrect
  2. BAccept the vendor certification as a substitute because validation of proprietary code is impossible
  3. CUse the model only for low-value decisions and exempt it from the inventory
  4. DDelay validation until the first year of losses reveals performance problems

Explanation

Guidance states vendor models are subject to the same validation expectations as internal ones. Where code is a black box, the bank should use sensitivity analysis, benchmarking, outcomes analysis, and contractual access to developmental evidence. Certification does not replace independent validation, and exemption from the inventory or waiting for losses is inadequate.

Did you get it right without looking?

One question tells you little. A timed set on Supervisory Guidance on Model Risk Management shows your real accuracy, how long you take and where you lose marks.

More Supervisory Guidance on Model Risk Management questions