How Should a Bank’s Internal Audit Function Interact with the Model Validation Team?

Concept

The relationship between a bank’s Internal Audit (IA) function and its Model Validation Team (MVT) is a foundational element of a sound model risk management framework. This interaction is prescribed by regulatory guidance, most notably the Federal Reserve’s SR 11-7, and is structured around the “three lines of defense” paradigm that underpins modern financial risk management. Understanding this dynamic requires viewing the two functions not as redundant checks, but as distinct, yet complementary, components of a system designed to provide comprehensive assurance over the bank’s use of quantitative models.

At its core, the system is designed to manage model risk, which is the potential for adverse consequences from decisions based on incorrect or misused models. This risk is pervasive in banking, affecting everything from credit underwriting and asset valuation to capital adequacy and stress testing. The MVT constitutes a critical part of the second line of defense, which is typically the independent risk management function. Its primary mandate is to perform an “effective challenge” of the bank’s models.

This involves a granular, technical assessment to verify that models are performing as expected, are conceptually sound, and that their limitations are well understood and documented. The MVT’s work is deeply technical, involving activities like backtesting, sensitivity analysis, and reviewing the underlying mathematical and statistical theories of a model.

The structural separation of Internal Audit and the Model Validation Team ensures independent verification of the very processes designed to control model risk.

Conversely, the Internal Audit function serves as the third and final line of defense. Its perspective is broader and its primary responsibility is to provide independent assurance to the board of directors and senior management that the overall model risk management framework is designed appropriately and operating effectively. IA does not, and should not, re-perform the model validations conducted by the MVT. Instead, IA audits the process of model risk management.

This includes assessing the independence and competency of the MVT, the rigor of the validation procedures, the adequacy of the model inventory, and the effectiveness of the governance and oversight structure. IA’s role is to verify that the first and second lines of defense are functioning as intended, providing a holistic assessment of the bank’s capability to manage model risk across the enterprise.

Strategy

A strategic framework for the interaction between Internal Audit and the Model Validation Team is built upon the principle of complementary oversight within the three lines of defense. The objective is to create a system of checks and balances that ensures the integrity of the bank’s models without creating duplicative effort. This strategy hinges on clear delineation of roles, robust communication protocols, and a risk-based approach to audit planning.

A System of Defined Responsibilities

The entire strategy rests on a clear understanding that IA and MVT have fundamentally different missions. The MVT’s focus is on the individual model’s integrity, while IA’s focus is on the systemic integrity of the risk management framework. The MVT provides the first layer of independent review over the model developers and users (the first line). IA then provides a subsequent layer of assurance over the MVT and the broader governance structure.

This separation is crucial for maintaining independence. If IA were to perform validations, it would be auditing its own work, a clear violation of auditing standards. Therefore, the strategy must ensure IA can leverage the work of the MVT while maintaining the objectivity required to critically assess it.

A successful strategy enables Internal Audit to rely on the Model Validation Team’s work, which is achieved by first verifying the team’s competence, independence, and process rigor.

Key Areas of Strategic Alignment

The collaboration between the two functions can be structured around several key activities throughout the year:

• Annual Planning ▴ At the beginning of the audit cycle, IA should review the MVT’s annual validation plan. This allows IA to understand the scope of planned validation activities, identify high-risk models, and align its own audit plan accordingly. IA can assess whether the MVT’s plan adequately covers the bank’s model inventory, prioritizing models with higher materiality and risk.
• Information Sharing ▴ A formal protocol for sharing information is essential. IA should have read-only access to the complete model inventory, all model validation reports, issue tracking logs, and MVT policies and procedures. This transparency allows IA to conduct continuous monitoring and adjust its audit focus based on emerging risks identified by the MVT.
• Assessing Competence and Independence ▴ A core part of IA’s strategy is to periodically assess the MVT itself. This involves reviewing the qualifications, skills, and training of the validation staff, as well as the team’s organizational stature and reporting lines. An effective MVT must have the authority and expertise to challenge model developers and owners, and IA must verify that this “effective challenge” is present.

The following table outlines the distinct responsibilities of each function, illustrating their complementary nature within the model risk ecosystem.

Execution

The operational execution of the relationship between Internal Audit and the Model Validation Team translates strategy into a series of tangible, repeatable processes. This operational cadence is structured around the audit cycle, ensuring that IA’s assessment of the model risk management framework is thorough, evidence-based, and drives continuous improvement.

The Internal Audit Process for Model Risk

An audit of the model risk management framework is a specialized engagement that requires significant technical understanding. It typically follows a phased approach, from planning to reporting, with specific procedures designed to test the efficacy of the second line’s validation activities.

Phase 1 ▴ Audit Planning and Scoping

The foundation of an effective audit is a comprehensive planning phase. During this stage, the audit team determines the scope and objectives of their review.

1. Risk Assessment of Model Inventory ▴ The audit begins with a review of the bank’s complete model inventory. IA, in conjunction with its own risk assessment, will stratify the model population based on factors like financial impact, complexity, and regulatory scrutiny. The table below shows a simplified risk-rating matrix that IA might use to prioritize models for review.
2. Review of MVT Documentation ▴ The audit team will review all governing policies and procedures for the MVT. This includes the Model Risk Management Policy, the Model Validation Procedures, and charters for any relevant governance committees.
3. Selection of a Sample ▴ Based on the risk assessment, IA selects a sample of models for detailed review. This sample should include a mix of high-risk models, models validated during the period, and potentially models from different business lines to ensure broad coverage.

A risk-based approach ensures that audit resources are focused on the areas of greatest potential risk to the organization.

Models scoring higher in this matrix would be prioritized for inclusion in the audit sample.

Phase 2 ▴ Audit Fieldwork and Testing

This is the core of the audit, where the team executes its test plan to gather evidence. The objective is to assess the design and operating effectiveness of the MVT’s processes.

The core of audit execution involves a sample-based review of model validation files to verify that the second line’s “effective challenge” is robust and well-documented.

For each model selected in the sample, the audit team will review the MVT’s complete validation file. The goal is to confirm that the validation was conducted in accordance with bank policy and regulatory expectations. The following is a detailed checklist of procedures IA would perform:

• Verification of Independence ▴ IA confirms that the MVT staff who performed the validation are organizationally separate from the model’s developers and owners.
• Assessment of Competence ▴ The audit team reviews the credentials and experience of the validation staff to ensure they possess the necessary technical skills for the specific model type.
• Review of Conceptual Soundness Assessment ▴ IA verifies that the MVT critically reviewed the model’s underlying theory and logic. This includes checking that the MVT assessed the reasonableness of all key assumptions.
• Data Validation Review ▴ The audit confirms that the MVT independently tested the quality and integrity of the data used to build and test the model. This includes checking for accuracy, completeness, and relevance.
• Review of Independent Testing ▴ IA examines the evidence of the MVT’s own testing, such as backtesting or benchmarking results. The audit checks that the MVT’s testing was rigorous and that any exceptions were properly investigated and explained.
• Assessment of Findings and Recommendations ▴ IA reviews the issues identified by the MVT during the validation. The audit assesses whether the severity of the findings is appropriate and whether the MVT’s recommendations are clear, actionable, and address the root cause of the issue.
• Review of Reporting ▴ The audit team reviews the final validation report to ensure it was communicated clearly to all relevant stakeholders, including the model owner and senior management.

Phase 3 ▴ Reporting and Follow-Up

Upon completion of fieldwork, IA synthesizes its findings into a formal audit report. This report is presented to senior management and the Audit Committee of the Board. The report will identify any systemic weaknesses in the model risk management framework, such as deficiencies in the validation process, inadequate governance, or insufficient resources for the MVT.

Each finding will be accompanied by a specific, actionable recommendation and a timeline for remediation. IA is then responsible for tracking the implementation of these recommendations to ensure the control environment is strengthened.

Reflection

The intricate dance between Internal Audit and the Model Validation Team forms the bedrock of a resilient financial institution. Viewing this interaction merely as a compliance exercise misses the point entirely. It is a dynamic feedback loop, a system designed not for static assurance but for perpetual enhancement. The rigor of the Model Validation Team sharpens the accuracy of individual instruments, while the expansive oversight of Internal Audit tunes the entire orchestra of risk management.

The true strength of this framework is revealed not in a single audit report or a successful validation, but in the institution’s evolving ability to understand, quantify, and mitigate the inherent uncertainty of its own quantitative tools. The ultimate goal is to cultivate an environment where “effective challenge” is not an event, but a continuous state, embedding a deep, systemic intelligence that fortifies the bank against future volatility.