But really: what is a DQM?
In SS1/23, the PRA has provided a broad and expanded definition of models to include DQMs. The supervisory statement explains: “For the purposes of the expectations contained within this SS, a model is defined as a quantitative method that applies statistical, economic, financial, or mathematical theories, techniques, and assumptions to process input data into output.” While traditional models are generally understood to be stochastic, or non-deterministic subsets of quantitative methods, the broader definition in SS1/23 includes DQMs, or deterministic quantitative models, as a subset of models.
These newly identified models may be owned by IT, but they aren’t always. They can look like spreadsheets, custom applications, and more, and can be owned by end-users. Between the ubiquity of DQMs and the fact that they have not been otherwise governed by the PRA, this new statement demands that financial institutions reassess their model risk in light of this expanded definition.
Why are they important?
Currently, most DQMs are governed according to the same guidelines that IT uses to govern its applications: by virtue of access controls, change controls, and role-based permissions. But many should be subjected to much more rigorous controls. Firms must understand DQMs in terms of their use cases: what are these models used for? When DQMs are used for financial reporting purposes, liquidity, forecasting, capital, and other functions along these lines, they demand to be governed to a higher standard. Proper governance of these DQMs requires that their controls and tests respond to the business purpose the method serves, the methodologies underpinning it, and the assumptions in place that support its functionality.
How should firms address SS1/23’s changes for DQMs?
Firms must demonstrate some form of compliance by May 17, 2024.
On the one hand, teams can get started and make fast gains by looking at the DQMs they have already identified and evaluate the level of governance they currently apply. If a DQM is subject to IT-esque governance, companies can perform a “governance up-lift” by beginning to ask what kind of testing must be carried out throughout the DQM lifecycle, as well as what kind of monitoring must take place.
