<img src="https://ws.zoominfo.com/pixel/pIUYSip8PKsGpxhxzC1V" width="1" height="1" style="display: none;">

FDIC Guidance: Model Risk Management of Third-party Vendors

author Michael Berman
1 min read
Jun 21, 2017

FDIC-regulated banks with more than $1 billion in assets and those that use a model that is “significant, complex, or poses elevated risk to the institution” will be subject to the Supervisory Guidance on Model Risk Management, the same guidance already followed by the Fed and the OCC.

Models are already subject to safety and soundness standards, but FIL-22-2017 defines models as “a quantitative method, system, or approach that applies statistical, economic, financial, or mathematical theories, techniques, and assumptions to process input data into quantitative estimates.” This goes well beyond simple mathematical calculations, and an FI’s approach will be influenced by its risk exposure, complexity and model usage.

It’s not just FI models that fall under the guidance. Many FIs depend on vendor-supplied models, which require management to limit risk. The guidance frequently mentions third-party vendors, addressing them within each element of risk model management, including:

  • Model development, implementation and use. Third-party data should be accurate and relevant.
  • Model validation. Proprietary components can make validating vendor models especially challenging. To justify their decision to use a vendor, an FI needs “developmental evidence” from a vendor to explain how its model was designed and should work. The vendor should also provide the results of tests and ongoing performance analysis. FIs need to know whether the data its vendor is using is appropriate and assess the vendor’s model results by using benchmarks, including the FIs own outcomes. There needs to be contingency plans if the vendor is unable to perform modeling.
  • Governance, policies and controls. There should be policies for deciding on a vendor model and for validating vendor models and third-party products. Third-party approaches should be documented.

Models are never perfect, and that’s why they introduce risk. That risk can be further amplified if an FI doesn’t understand where and how a vendor creates a model or what kind of data it’s using. When conducting vendor management, don’t forget to protect your institution with proper model risk management.

 

Related: Creating Reliable Risk Assessments

Subscribe to the Nsight Blog

All Topics Risk & Compliance Product Insight Banks Lending Compliance Credit Unions Risk Management Fair Lending Nfairlending Cluster: Risk Management Compliance Lending Compliance Management Integrated Risk Blog Regulatory Compliance Management Nrisk News & Updates HMDA Risk Mortgage Lenders Vendor Management Ncomply Business Resiliency CRA Lending Compliance Blog Vendor CFPB Ncontinuity Third-Party Vendor Management Business Continuity Cybersecurity Fintech NVendor Strategic Planning Ncyber Regulatory Updates Ntransmittal Audits & Findings Regulatory Compliance OCC Company Culture Audit Nverify Compliance Management Exams FDIC Nfindings Findings NCUA Contract Management Employee Intranet Business Continuity Management Contract FRB Findings Management Enterprise Risk Management FFIEC Ncontracts manager Third-Party Vendors Vendor Risk Artificial Intelligence Vendor Risk Management Wealth Management 1071 ABA Bank Access Control Audit Findings Board Portal Call Report Compliance Risk Cybersecurity Assessment Digital Tansformation Due Diligence Efficiency Employee Engagement Exam findings FIEC Governance and Risk Management Inc. 5000 Internal Audit Management Mortgage Lending Nboardportal Verify integrated risk management
Risk Management Planning
Risk Management

Risk Management Planning

Oct 31, 2018 1 min read
Third-Party Risk Management
Risk Management

Third-Party Risk Management

Nov 12, 2018 2 min read
RiskTech vs RegTech
Risk Management

RiskTech vs RegTech

Jan 12, 2017 2 min read