The Case for Transforming Model Risk Management: Prepare for AI Business Risks

By November 1, 2019March 6th, 2021No Comments


Banks will need to evolve and industrialize their MRM functions in the world of big data and AI since AI based models pose unique challenges in terms of business risk management.

Executive Summary

Banks and financial institutions’ traditional model risk management (MRM) framework can be extended to handle and manage risks posed by artificial intelligence (AI).  However, banks will need to evolve and industrialize their MRM functions in the world of big data and AI since AI based models pose unique challenges in terms of business risk management.  Banks will need to transform their MRM functions into using a new set of skills, tools and processes to help augment traditional capabilities.  

Model Risk Management: A Key Piece in Banking’s Risk Management Framework

Model risk has been a focus for the risk management function within banking and insurance for a number of decades, but really took on regulatory significance and formal definition in the aftermath of the 2008 financial crisis.  Model risk management has since become a critical capability to banking institutions, enabling assurance and adherence to regulations and prudential standards. A typical bank now has anywhere between 100 and 3,000 models under the purview of MRM teams.  MRM groups have grown considerably in recent years, and that growth is expected to continue.  

MRM Plays a Central Role in Banking AI Transformation

AI is increasingly becoming a strategic and transformational capability for banks, projected to generate more than $250 billion per McKinsey Global Institute.  While AI is promising, it comes with a range of challenges such as fairness, bias, robustness, and explainability. Unfortunately, regulatory agencies but have issued little guidance for AI use beyond stipulating that banks are accountable for business risks associated with AI.  MRM functions seem to be the logical place for instituting AI model risk management, and are expected to take on a central role in helping banks drive broad AI adoption.

Where is MRM Today with Managing AI Business Risk?

MRM functions will not need to create entirely new operating models for AI, however, MRM teams will need new tools and processes to handle AI models.  MRM functions today are not fully enabled to handle AI models, as demonstrated by challenges may banks have had in bringing such models into production.  Further, AI associated business risk is much more complex to manage, due largely to AI’s complexity, reliance on big data, and wide ranging business impacts.  MRM functions will need to be augmented with the requisite skills, tools and processes to handle new AI associated business risks.

The Case for MRM Transformation

Given the evolving nature of business risk due to AI, MRM functions will require no less than a small transformation to be able to extend their functioning to address AI models.  Since AI models are designed, developed and managed differently than traditional statistical models, MRM teams will need to adjust their model intake, validation and monitoring processes appropriately.  As the volume of models grows, MRM teams will need to set up a model validation factory operation which can effectively deal with the scale and complexity of enterprise AI deployments.

Where do MRM Functions Go From Here?

The first step to planning such a transformation is understanding the true nature of the challenge posed by AI based models in an enterprise setting.  MRM teams should start small by managing AI models in discrete, low-risk application areas, such as marketing. A new set of tools and techniques will be required, and MRM functions can start building capabilities around this tooling to gradually advance to more complex models in time.  Once MRM teams understand the challenge, they can begin understanding and implementing the capabilities required for a successful transformation.