By Henry Umney, CEO, ClusterSeven

The UK’s Prudential Regulatory Authorities (PRA) Model Risk Management Principles For Stress Testing (SS3/18), which took effect on 01 June 2018, raises the bar for many institutions in the way that they undertake model risk management practices when using stress test models. SS3/18 also extends the principles, that previously only applied to the largest UK banks, to all banks and building societies– regardless of size.

The PRA’s principles for stress testing focus on model definition and inventory management, model governance, model development, as well as model review. They are designed to bring consistency in stress testing across the board to enhance overall resilience and drive better like-for-like comparison.

The ‘spreadsheet’ problem

As institutions step up their efforts to meet these latest stress testing standards, they will need to carefully consider their approach to their organisations’ use of spreadsheets. Excel spreadsheets are a vital tool in modelling, either as the model itself or as a vital component for gathering data or reporting results.

Henry Umney

The number one reason why institutions use spreadsheets is for the power and flexibility these tools provide for data gathering, scenario modelling, and reporting and they are keen to maintain this flexibility. However, typically, seldom are any standards enforced or adhered to in the way these spreadsheets are used. Consequently, unless there is transparency and control instituted in how a bank’s spreadsheet-based stress testing models are updated, embedding thePRA’s Model Risk Management principles will prove difficult for banks and building societies

Stress testing principles and automated spreadsheet management

Banks are required to implement these principles as ‘business-as-usual’, and demonstrate it to management, auditors and regulators alike. Its implementation also forms part of the Senior Management Regime, as it is the responsibility of senior management to implement and oversee its provisions.

Where institutions utilise spreadsheets in their stress testing models, applying automated spreadsheet management capabilities can help them to adhere to the PRA’s principles:

• Inventory management–Fundamental to this is having an understanding of the model inventory as well as the spreadsheet environment and the intricate data lineages across the landscape. Spreadsheet management tools can conduct a process of discovery to provide visibility of the stress testing models, data feeds and their complex relationships with each other as well as the models themselves. Institutions can then classify and inventory the files and models based on the level of risks they pose to the business and bring the riskiest spreadsheets under management for control, continuous monitoring and quality assurance.

• Model Governance –Spreadsheet management enables institutions to demonstrate the validity of stress testing models and the accuracy of the outputs to credibly satisfy the regulators. Such solutions make it possible to embed change management processes and control mechanisms to ensure the integrity of the data used and the models themselves. Furthermore, through automation, institutions can periodically re-attest the models, and the data that feed them, to ensure that they are indeed working as desired by the organisation. 

• Model development and Implementation – Automated spreadsheet management also helps institutions to systematically review, revise and approve their spreadsheet models by helping understand how these models are structured, how they source their data and understand what changes have been made the spreadsheets throughout the development and implementation process. It provides a documented, fully auditable process, to ensure that spreadsheet-based models are developed fully in line with the needs of the business, as well as an efficient effective method of providing the type of evidence that regulators typically seek.

• Model validation and independent review – Ensuring the stress testing models are an accurate reflection of the business and the wider economy is key to ensuring that the final results are meaningful and useful. Again, automated spreadsheet management helps provide the insight into how complex spreadsheet models are structured, how they source their data and how they have evolved. This enables auditors, reviewers, as well as stress-testing teams and management, to focus on assessing the relevance, accuracy, and any potential deficiencies of these models, rather than spending time trying to understand the structure of a model, and assessing its accuracy. 

While not a principle of SS3/18, being able to deliver fully auditable and transparent reports is implicit. An automated approach to spread sheet model risk management and governance provides institutions an audit trail to demonstrate the provenance, and ensure accuracy, transparency and integrity of reporting information. They can also automatically gather the attestation information, complete with date/time stamps as proof.

In adopting this approach, banks and building societies will be able to capture the stress testing principles of the PRA, whilst maintaining the flexibility the business requires from spreadsheets and delivering the transparency required by management and regulator alike. 

About the author

Henry Umney is CEO of ClusterSeven. He joined the company in 2006 and for over 10 years was responsible for the commercial operations of ClusterSeven, overseeing globally all Sales and Client activity as well as Partner engagements. In July 2017, he was appointed CEO and is strongly positioned to take the business forward. He brings over 20 years’ experience and expertise from the financial service and technology sectors. Prior to ClusterSeven, he held the position of Sales Director in Microgen, London and various sales management positions in AFA Systems and DART, both in the UK and Asia. ClusterSeven Twitter Handle: @ClusterSeven