Machine learning has permeated almost all areas in which inferences are drawn from data. The range of applications in the financial industry spans from credit rating and loan approval processes to automated trading, fraud prevention and anti-money laundering. Machine learning has demonstrated significant uplift in these business areas and its use will continue to be explored in the financial industry. What challenges and potential benefits will machine learning algorithms have for model risk management in banks and other financial institutions?
The foundation of every model risk management framework is the correct identification of the models in scope and their classification according to the intensity of model risk management activities required for each of them. Regarding the correct classification of machine learning models as such, two main changes can be observed:
Model identification process: On one hand, not all institutions have at their disposal an automatically updated model inventory and so there is reliance on punctual registration and verification processes. Due to the change from a stable number of models to a fast changing, unstable amount of machine learning models with short time-to-market requirements, more iterative and automatized processes will be required.
Model definition: On the other hand, the already often highly debated decision of whether certain algorithms should be considered a model becomes more complicated as machine learning models take less traditional forms. For example, chat-bots in the client service that propose certain products to customers based on their own criteria do not correspond at a first glance to the traditional idea of a model.
Once the model is inventoried, the activities and effort required throughout the model lifecycle stages are determined. Banks aim at classifying model types into groups based on similarities to leverage synergies throughout the lifecycle. In the past, the resulting grouping of similar models in an inventory often resulted in quite intuitive groups based on the type of risk the models addressed (e.g., credit risk, market risk) and the high-level model type (e.g., PD, LGD). However, the wide range of different emerging machine learning technologies with multiple different formulations, applications and data usage might require a grouping based on different characteristics. Institutions should therefore extend their current model risk classification systems with additional attributes:
- Complexity of methodology and design: The complexity of the model design becomes more relevant than ever. For machine learning models — which learn autonomously — new ways of comparing model complexity have to be found. This can encompass chosen methodologies that determine the level of interpretability or indicators of the level of transparency, such as the number of hidden layers or the number of (hyper) parameters.
- Data usage: Data drives the complexity of the ML methodology and thus the difficulty in assessing the model components. Influencing factors to be evaluated are the volume of required data or number of data features, the complexity of data structures (e.g., unlabelled, metadata), the quality of data (e.g., poorly labelled, low quality or unstructured data) and whether there are variable interactions and transformations.
- Output parameters: A further decisive factor is whether the model in question is based on supervised machine learning (with delimited output parameters) or unsupervised learning, in which there is no direct way to evaluate output accuracy (e.g., sentiment analysis, clusters, recommendations).
- Model recalibration: An institution might determine if the model in question is static or requires continuous recalibrations. Thereby, the complexity varies depending on whether a potential recalibration of the model would require an entire redevelopment, or if the initial model structure might be maintained and only retraining the model with recent data would be required.
- Testing and monitoring: The capacity to conduct effective challenge drives the model prioritization, including the availability of benchmark models, the availability of cross validation testing showing good performance, and parameter stability across the samples.
Some banks have already developed frameworks to deal with the model risks of machine learning applications, while other banks are still in the midst of soul searching for viable starting points. There definitely is a need to share emerging industry best practices and to develop a comprehensive framework to assess model risks in machine learning applications. As a starting point, there is a white paper on machine learning from the Model Risk Mangers’ International Association (mrmia.org).
Here are some thoughts on next steps to establish a successful model risk framework.
- Begin with existing model risk frameworks. Even though machine learning introduces new challenges for model risk management, enhanced model risk frameworks should not start from scratch. Financial institutions and regulators have gained much experience in risk model validation in the last years that could serve as solid basis for model governance topics related to machine learning.
- Consider the new role of data. The new paradigm states that machine learning is “model free”, and everything depends only on the data. Though that may not be literally true, the more important role of data needs to be addressed within model risk governance frameworks. The various forms of bias, overfitting, population drift and regime changes need to be considered.
- Add new perspectives to your model inventory. When it comes to model risk classification, machine learning will increase the relevance of ethical aspects due to data bias, explainability of model results, and the role of the recalibration process. To facilitate a comprehensive model risk management framework, these attributes need to be integrated into the model inventory.