SECTION 1: LEARNING OBJECTIVES
By the end of this lesson, you will be able to:
-
Define model risk and its importance in digital banking.
-
Identify the key components of model risk management.
-
Apply model validation and governance frameworks.
-
Understand AI-specific risks – bias, explainability, and robustness.
-
Implement model monitoring and performance tracking.
-
Measure model risk using key metrics.
-
Understand the regulatory framework – SR 11-7, EU AI Act.
-
Develop a model risk strategy for a digital bank.
SECTION 2: WHAT IS MODEL RISK?
2.1 Definition
Model risk is the risk of adverse consequences from decisions based on incorrect or misused model outputs. It arises from errors in model design, development, implementation, or use.
2.2 Why Model Risk Matters
| Reason | Description |
|---|---|
| Regulatory Compliance | SR 11-7 requires model risk management. |
| Financial Loss | Incorrect models can lead to losses. |
| Reputational Damage | Model failures damage trust. |
| Fair Lending | Biased models can discriminate. |
| Operational Risk | Model errors disrupt operations. |
2.3 Types of Model Risk
| Type | Description | Example |
|---|---|---|
| Conceptual Error | Incorrect model theory. | Wrong assumptions. |
| Data Error | Poor data quality. | Incomplete or biased data. |
| Implementation Error | Coding mistakes. | Bugs in model code. |
| Misuse | Using model outside its intended purpose. | Wrong application. |
| Drift | Model performance declines over time. | Performance decay. |
SECTION 3: MODEL RISK MANAGEMENT FRAMEWORK
3.1 Model Lifecycle
┌─────────────────────────────────────────────────────────────────────────────┐ │ MODEL LIFECYCLE │ ├─────────────────────────────────────────────────────────────────────────────┤ │ │ │ ┌─────────────┐ ┌─────────────┐ ┌─────────────┐ ┌─────────────┐ │ │ │ Planning │ │ Development │ │ Validation │ │ Deployment │ │ │ │ (Business │ ──→ │ (Data, │ ──→ │ (Testing, │ ──→ │ (Production)│ │ │ │ need) │ │ Features) │ │ Review) │ │ │ │ │ └─────────────┘ └─────────────┘ └─────────────┘ └─────────────┘ │ │ │ │ │ v │ │ ┌─────────────┐ ┌─────────────┐ │ │ │ Monitoring │ │ Retirement │ │ │ │ (Performance│ ──→ │ (Decommission)│ │ │ │ tracking) │ │ │ │ │ └─────────────┘ └─────────────┘ │ │ │ └─────────────────────────────────────────────────────────────────────────────┘
3.2 Model Validation Framework
| Component | Description | Activities |
|---|---|---|
| Conceptual Soundness | Review theoretical basis. | Literature review, peer review. |
| Data Quality | Assess data completeness, accuracy. | Data profiling, quality checks. |
| Performance Testing | Evaluate model accuracy. | AUC, KS, calibration. |
| Stability Testing | Test performance over time. | Out-of-time validation. |
| Benchmarking | Compare with alternative models. | Simpler models, industry benchmarks. |
| Fairness Testing | Test for disparate impact. | Disparate impact analysis. |
3.3 SR 11-7 Requirements
| Requirement | Description | Implementation |
|---|---|---|
| Model Inventory | Maintain inventory of all models. | Centralised repository. |
| Model Validation | Independent validation. | Validation reports. |
| Model Monitoring | Ongoing performance monitoring. | Performance dashboards. |
| Model Governance | Oversight and accountability. | Model risk committee. |
SECTION 4: AI-SPECIFIC RISKS
4.1 Key AI Risks
| Risk | Description | Mitigation |
|---|---|---|
| Bias | Model discriminates against protected groups. | Fairness testing, bias mitigation. |
| Explainability | Black-box models are hard to interpret. | SHAP/LIME, model cards. |
| Robustness | Models vulnerable to adversarial attacks. | Adversarial testing, robust training. |
| Drift | Performance declines over time. | Monitoring, retraining. |
| Hallucination | Generative AI produces incorrect information. | Human review, grounding. |
4.2 Explainability Techniques
| Technique | Description | Application |
|---|---|---|
| SHAP | Shapley values for feature contribution. | Model explainability. |
| LIME | Local interpretable models. | Local explanations. |
| Feature Importance | Relative importance of features. | Global explanations. |
| Model Cards | Document model details. | Transparency. |
SECTION 5: REGULATORY FRAMEWORK
5.1 Key Regulations
| Regulation | Region | Focus |
|---|---|---|
| SR 11-7 | US | Model risk management. |
| EU AI Act | EU | AI regulation (high-risk AI). |
| GDPR | EU | Right to explanation. |
| ECOA / Fair Lending | US | Fairness, bias testing. |
5.2 SR 11-7 Key Requirements
| Requirement | Description |
|---|---|
| Model Inventory | Maintain complete inventory. |
| Model Validation | Independent validation of all models. |
| Model Monitoring | Ongoing performance monitoring. |
| Model Governance | Board and committee oversight. |
| Documentation | Comprehensive model documentation. |
SECTION 6: IMPLEMENTATION IN PYTHON – MODEL RISK TOOLS
# =================================================================== # MODULE 8, LESSON 6: MODEL RISK AND AI RISK MANAGEMENT # =================================================================== import pandas as pd import numpy as np import matplotlib.pyplot as plt import seaborn as sns from sklearn.model_selection import train_test_split from sklearn.ensemble import RandomForestClassifier from sklearn.metrics import roc_auc_score, confusion_matrix import warnings warnings.filterwarnings('ignore') print("="*70) print("MODEL RISK AND AI RISK MANAGEMENT") print("="*70) # ---------------------------------------------------------------- # PART A: MODEL INVENTORY # ---------------------------------------------------------------- print("\n" + "-"*60) print("PART A: Model Inventory") print("-"*60) models = pd.DataFrame({ 'Model ID': ['M001', 'M002', 'M003', 'M004', 'M005'], 'Model Name': [ 'Credit Scoring v3.2', 'Fraud Detection v2.1', 'AML Transaction Monitoring', 'Customer Churn Prediction', 'Marketing Propensity' ], 'Type': [ 'Credit Risk', 'Fraud Detection', 'AML', 'Customer Analytics', 'Marketing' ], 'Owner': [ 'Credit Risk Team', 'Fraud Team', 'Compliance Team', 'Data Science Team', 'Marketing Team' ], 'Status': [ 'Deployed', 'Deployed', 'Validation', 'Deployed', 'Development' ], 'Risk Rating': [ 'High', 'High', 'High', 'Medium', 'Medium' ], 'Last Validation': [ '2024-03-15', '2024-04-20', '2024-05-10', '2024-02-01', 'N/A' ], 'Next Validation': [ '2025-03-15', '2025-04-20', '2025-05-10', '2025-02-01', '2025-06-01' ] }) print("Model Inventory:") print(models.to_string(index=False)) # ---------------------------------------------------------------- # PART B: MODEL VALIDATION DASHBOARD # ---------------------------------------------------------------- print("\n" + "-"*60) print("PART B: Model Validation Dashboard") print("-"*60) # Simulate model performance data np.random.seed(42) model_performance = pd.DataFrame({ 'Model': ['Credit Scoring', 'Fraud Detection', 'AML Monitoring', 'Churn Prediction'], 'AUC': [0.85, 0.92, 0.78, 0.81], 'KS': [0.42, 0.55, 0.35, 0.38], 'Calibration (H-L p)': [0.18, 0.22, 0.09, 0.15], 'Validation Status': ['Pass', 'Pass', 'Pass', 'Pass'], 'Issues': ['None', 'Minor', 'None', 'Data quality concerns'] }) print("Model Validation Dashboard:") print(model_performance.to_string(index=False)) # Visualise fig, axes = plt.subplots(1, 2, figsize=(14, 5)) # AUC and KS ax = axes[0] x = np.arange(len(model_performance)) width = 0.35 ax.bar(x - width/2, model_performance['AUC'], width, label='AUC', color='blue', alpha=0.7) ax.bar(x + width/2, model_performance['KS'], width, label='KS', color='green', alpha=0.7) ax.set_xlabel('Model') ax.set_ylabel('Score') ax.set_title('Model Performance Metrics') ax.set_xticks(x) ax.set_xticklabels(model_performance['Model']) ax.legend() ax.axhline(y=0.80, color='red', linestyle='--', label='AUC Target (0.80)') ax.axhline(y=0.35, color='orange', linestyle='--', label='KS Target (0.35)') ax.grid(True, alpha=0.3) # Validation Status ax = axes[1] status_counts = model_performance['Validation Status'].value_counts() ax.pie(status_counts.values, labels=status_counts.index, autopct='%1.1f%%') ax.set_title('Validation Status') plt.tight_layout() plt.savefig('model_validation.png', dpi=300, bbox_inches='tight') plt.show() print("Model validation visualisation saved as 'model_validation.png'") # ---------------------------------------------------------------- # PART C: BIAS DETECTION # ---------------------------------------------------------------- print("\n" + "-"*60) print("PART C: Bias Detection in AI Models") print("-"*60) # Generate data with protected attribute np.random.seed(42) n = 2000 # Group A and B group_a = np.random.choice([0, 1], n, p=[0.7, 0.3]) # Credit data with bias df_bias = pd.DataFrame({ 'income': np.random.gamma(5, 20, n) + 20, 'credit_score': np.random.normal(700, 50, n).clip(550, 850).astype(int), 'dti': np.random.beta(2, 5, n) * 60, 'group': group_a }) # Generate default with bias log_odds = (-4.5 + 0.04 * df_bias['dti'] - 0.005 * df_bias['credit_score']) log_odds += 0.3 * df_bias['group'] # Bias: Group B has higher default prob = 1 / (1 + np.exp(-log_odds)) df_bias['default'] = np.random.binomial(1, prob) # Train model features = ['income', 'credit_score', 'dti'] X = df_bias[features] y = df_bias['default'] sensitive = df_bias['group'] X_train, X_test, y_train, y_test, s_train, s_test = train_test_split( X, y, sensitive, test_size=0.3, random_state=42 ) model = RandomForestClassifier(n_estimators=100, max_depth=8, random_state=42) model.fit(X_train, y_train) y_pred = model.predict(X_test) y_pred_proba = model.predict_proba(X_test)[:, 1] # Fairness metrics def fairness_metrics(y_true, y_pred, sensitive): groups = np.unique(sensitive) metrics = {} for g in groups: mask = sensitive == g metrics[g] = { 'approval_rate': y_pred[mask].mean(), 'tpr': np.mean(y_pred[mask] & y_true[mask]) / np.mean(y_true[mask]) if np.mean(y_true[mask]) > 0 else 0, 'fpr': np.mean(y_pred[mask] & ~y_true[mask]) / np.mean(~y_true[mask]) if np.mean(~y_true[mask]) > 0 else 0, 'count': mask.sum() } rates = [metrics[g]['approval_rate'] for g in groups] tprs = [metrics[g]['tpr'] for g in groups] return { 'demographic_parity_difference': max(rates) - min(rates), 'demographic_parity_ratio': min(rates) / max(rates) if max(rates) > 0 else 0, 'equal_opportunity_difference': max(tprs) - min(tprs) } fairness = fairness_metrics(y_test, y_pred, s_test) print("Bias Detection Results:") print(f" Demographic Parity Difference: {fairness['demographic_parity_difference']:.4f}") print(f" Demographic Parity Ratio: {fairness['demographic_parity_ratio']:.4f}") print(f" Equal Opportunity Difference: {fairness['equal_opportunity_difference']:.4f}") if fairness['demographic_parity_ratio'] >= 0.8: print(" ✅ Passes 4/5 Rule") else: print(" ⚠️ Fails 4/5 Rule - Bias Detected") # ---------------------------------------------------------------- # PART D: MODEL MONITORING DASHBOARD # ---------------------------------------------------------------- print("\n" + "-"*60) print("PART D: Model Monitoring Dashboard") print("-"*60) # Simulate monitoring data monitoring_data = pd.DataFrame({ 'Time': range(1, 13), 'AUC': [0.85, 0.84, 0.83, 0.82, 0.81, 0.80, 0.79, 0.78, 0.77, 0.76, 0.75, 0.74], 'KS': [0.42, 0.41, 0.40, 0.39, 0.38, 0.37, 0.36, 0.35, 0.34, 0.33, 0.32, 0.31], 'Alert': ['No', 'No', 'No', 'No', 'No', 'No', 'Warning', 'Warning', 'Warning', 'Critical', 'Critical', 'Critical'] }) print("Model Performance Monitoring:") print(monitoring_data.to_string(index=False)) # Visualise fig, ax = plt.subplots(figsize=(12, 6)) ax.plot(monitoring_data['Time'], monitoring_data['AUC'], 'b-', linewidth=2, label='AUC') ax.plot(monitoring_data['Time'], monitoring_data['KS'], 'g-', linewidth=2, label='KS') ax.axhline(y=0.80, color='orange', linestyle='--', label='AUC Warning (0.80)') ax.axhline(y=0.75, color='red', linestyle='--', label='AUC Critical (0.75)') ax.axhline(y=0.35, color='orange', linestyle=':', label='KS Warning (0.35)') ax.axhline(y=0.30, color='red', linestyle=':', label='KS Critical (0.30)') ax.set_xlabel('Time') ax.set_ylabel('Score') ax.set_title('Model Performance Over Time') ax.legend() ax.grid(True, alpha=0.3) plt.tight_layout() plt.savefig('model_monitoring.png', dpi=300, bbox_inches='tight') plt.show() print("Model monitoring visualisation saved as 'model_monitoring.png'") # ---------------------------------------------------------------- # PART E: MODEL RISK METRICS # ---------------------------------------------------------------- print("\n" + "-"*60) print("PART E: Model Risk Metrics Dashboard") print("-"*60) model_metrics = pd.DataFrame({ 'Metric': [ 'Models in Production', 'Model Validation Rate', 'Model Performance (AUC)', 'Model Performance (KS)', 'Model Drift Incidents', 'Fairness Compliance', 'Model Documentation Completeness', 'Model Incident Rate' ], 'Current Value': [ '12', '75%', '0.78', '0.36', '3/year', '85%', '70%', '2/year' ], 'Target Value': [ '15+', '> 95%', '> 0.80', '> 0.38', '< 1/year', '> 95%', '> 90%', '0/year' ], 'Status': ['🟡', '🟡', '🟡', '🟡', '🟡', '🟡', '🟡', '🟡'] }) print("Model Risk Metrics Dashboard:") print(model_metrics.to_string(index=False)) # ---------------------------------------------------------------- # PART F: MODEL RISK ROADMAP # ---------------------------------------------------------------- print("\n" + "-"*60) print("PART F: Model Risk Roadmap") print("-"*60) roadmap = { "Phase 1 (0-6 months) – Foundation": { "Focus": "Build model risk foundation.", "Activities": [ "Establish model inventory.", "Implement model validation framework.", "Develop model governance policies.", "Implement model monitoring." ], "Success Metrics": ["Model inventory complete", "Validation framework in place"] }, "Phase 2 (6-12 months) – Scale": { "Focus": "Scale model risk capabilities.", "Activities": [ "Automate model monitoring.", "Implement bias testing.", "Enhance model explainability.", "Deploy model risk dashboards." ], "Success Metrics": ["Monitoring automated", "Bias testing implemented"] }, "Phase 3 (12-24 months) – Advanced": { "Focus": "Advanced model risk.", "Activities": [ "Implement AI-powered model monitoring.", "Deploy predictive model drift detection.", "Build model risk analytics.", "Achieve regulatory excellence." ], "Success Metrics": ["Advanced monitoring in place", "Regulatory compliance > 95%"] }, "Phase 4 (24+ months) – Leadership": { "Focus": "Industry-leading model risk.", "Activities": [ "Implement autonomous model monitoring.", "Build predictive risk intelligence.", "Achieve industry leadership.", "Establish risk culture." ], "Success Metrics": ["Industry-leading model risk", "Continuous improvement"] } } for phase, details in roadmap.items(): print(f"\n{phase}:") print(f" Focus: {details['Focus']}") print(" Activities:") for activity in details['Activities']: print(f" • {activity}") print(" Success Metrics:") for metric in details['Success Metrics']: print(f" • {metric}") # ---------------------------------------------------------------- # PART G: SUMMARY AND RECOMMENDATIONS # ---------------------------------------------------------------- print("\n" + "="*70) print("PART G: Summary and Recommendations") print("="*70) print(""" Model Risk and AI Risk Management – Key Takeaways: 1. Model risk arises from incorrect or misused model outputs. 2. Model lifecycle: planning → development → validation → deployment → monitoring → retirement. 3. Model validation: conceptual soundness, data quality, performance, stability, fairness. 4. AI-specific risks: bias, explainability, robustness, drift, hallucination. 5. Explainability: SHAP, LIME, feature importance, model cards. 6. Regulatory framework: SR 11-7, EU AI Act, GDPR, ECOA. 7. Key metrics: validation rate, performance, drift incidents, fairness compliance. Recommendations: - Establish model inventory and governance. - Implement model validation framework. - Conduct bias and fairness testing. - Ensure model explainability. - Monitor model performance continuously. - Maintain regulatory compliance (SR 11-7). """) print("="*70) print("END OF LESSON 6 – MODULE 8") print("="*70)
SECTION 9: SUMMARY FOR THE DATA PRACTITIONER
-
Model risk arises from incorrect or misused model outputs, leading to adverse consequences.
-
Model lifecycle includes planning, development, validation, deployment, monitoring, and retirement.
-
Model validation includes conceptual soundness, data quality, performance testing, stability testing, benchmarking, and fairness testing.
-
AI-specific risks include bias, explainability, robustness, drift, and hallucination.
-
Explainability techniques include SHAP, LIME, feature importance, and model cards.
-
Regulatory framework includes SR 11-7 (US), EU AI Act, GDPR, and ECOA/Fair Lending.
-
Key metrics include models in production, validation rate, model performance (AUC, KS), model drift incidents, fairness compliance, and model documentation completeness.
SECTION 10: RECOMMENDED NEXT STEPS
-
Establish model inventory and governance.
-
Implement model validation framework.
-
Conduct bias and fairness testing.
-
Ensure model explainability.
-
Monitor model performance continuously.
-
Maintain regulatory compliance (SR 11-7).
-
Prepare for Lesson 7: Third-Party Risk Management.