SECTION 1: LEARNING OBJECTIVES

By the end of this lesson, you will be able to:

  • Understand the regulatory landscape for AI and model governance in banking.

  • Develop a model governance framework aligned with SR 11-7, BCBS 239, and EU AI Act.

  • Implement a model inventory and lifecycle management system.

  • Conduct model validation – independent review, benchmarking, and stress testing.

  • Apply explainability and fairness requirements to ensure regulatory compliance.

  • Manage model risk – identification, assessment, mitigation, and monitoring.

  • Develop model documentation standards for regulatory submissions.

  • Implement model approval workflows – from development to retirement.

  • Use Python to create a model governance dashboard tracking model status, validation, and compliance.


SECTION 2: THE REGULATORY LANDSCAPE

2.1 Key Regulations for AI and Models in Banking
 
 
Regulation Scope Key Requirements
SR 11-7 US banking (all models) Model validation, documentation, independent review, ongoing monitoring.
BCBS 239 Risk data aggregation and reporting Data quality, lineage, timeliness, accuracy.
EU AI Act High-risk AI systems Conformity assessments, transparency, human oversight.
GDPR Data protection and privacy Right to explanation, data minimisation, privacy by design.
ECOA / FHA Fair lending No discrimination; disparate impact testing.
Basel III Capital adequacy Internal model governance and validation.
IFRS 9 / CECL Expected credit loss Model validation and calibration.
2.2 SR 11-7 – The Gold Standard

SR 11-7 (Supervisory Guidance on Model Risk Management) is the primary regulatory guidance for model governance in US banking.

Key Pillars:

 
 
Pillar Description Activities
Model Development Models must be conceptually sound. Clear documentation; theoretical basis; data validation.
Model Validation Independent review of models. Conceptual soundness; data quality; performance testing.
Model Monitoring Ongoing performance tracking. Performance metrics; drift detection; trigger-based review.
Governance Oversight and accountability. Model inventory; approval workflows; risk rating.

The Three Lines of Defence:

  • 1st Line: Model development and implementation.

  • 2nd Line: Independent model validation.

  • 3rd Line: Internal audit.


SECTION 3: MODEL GOVERNANCE FRAMEWORK

3.1 Components of a Model Governance Framework
 
 
Component Description Implementation
Model Inventory Centralised repository of all models. Database with model metadata, owner, status, risk rating.
Model Lifecycle From development to retirement. Stages: Planning → Development → Validation → Approval → Deployment → Monitoring → Retirement.
Risk Rating Assess model risk level. High/Medium/Low based on impact, complexity, and materiality.
Approval Workflow Sign-off process for each stage. Development → Validation → Business Approval → Deployment.
Documentation Comprehensive model documentation. Model card, validation report, monitoring report.
Validation Independent model review. Annual validation; trigger-based revalidation.
Monitoring Ongoing performance tracking. Monthly/quarterly performance reports.
Retirement Decommissioning models. Transition plan; archiving; final validation.
3.2 Model Risk Rating
 
 
Risk Level Characteristics Validation Frequency Escalation
High Material impact; complex; new methodology. Annual; trigger-based. Steering Committee.
Medium Moderate impact; established methodology. 18-24 months. Model Risk Committee.
Low Low impact; simple; well-understood. 2-3 years. Department head.
3.3 Model Lifecycle Stages
text
┌──────────────┐    ┌──────────────┐    ┌──────────────┐    ┌──────────────┐
│   Planning   │ → │ Development  │ → │  Validation  │ → │   Approval   │
│  (Business   │    │  (Data,      │    │  (Independent│    │  (Steering   │
│   Need)      │    │   Features)  │    │   Review)    │    │  Committee)  │
└──────────────┘    └──────────────┘    └──────────────┘    └──────────────┘
                                                                      │
                                                                      v
┌──────────────┐    ┌──────────────┐    ┌──────────────┐    ┌──────────────┐
│   Retirement │ ← │   Monitoring │ ← │   Deployment  │ ← │   Approval   │
│  (Decommission│    │  (Performance│    │  (Production) │    │  (Readiness) │
│   Model)     │    │   Tracking)  │    │               │    │              │
└──────────────┘    └──────────────┘    └──────────────┘    └──────────────┘

SECTION 4: MODEL VALIDATION

4.1 Validation Activities
 
 
Activity Description Tools/Methods
Conceptual Soundness Review theoretical basis and methodology. Literature review; peer review.
Data Quality Assess data accuracy, completeness, and timeliness. Data profiling; lineage tracking.
Performance Testing Evaluate model accuracy and stability. AUC, KS, calibration; backtesting.
Benchmarking Compare with alternative models. Simpler models; industry benchmarks.
Sensitivity Analysis Test model response to input changes. Scenario analysis; stress testing.
Stability Testing Test model performance over time. Out-of-time testing; rolling windows.
Fairness Testing Test for disparate impact. Demographic parity; equal opportunity.
4.2 Validation Report Structure
text
--- MODEL VALIDATION REPORT ---

1. Executive Summary
   - Model overview
   - Validation findings
   - Recommendations and decision

2. Model Overview
   - Model name and version
   - Owner and developer
   - Intended use and limitations
   - Methodology

3. Data Quality Assessment
   - Data sources and lineage
   - Data completeness and accuracy
   - Data transformations

4. Performance Assessment
   - AUC, KS, Gini coefficient
   - Calibration (Hosmer-Lemeshow)
   - Backtesting results

5. Robustness Testing
   - Sensitivity analysis
   - Stress testing
   - Benchmarking

6. Fairness Assessment
   - Disparate impact testing
   - Protected attribute analysis

7. Findings and Recommendations
   - Issues identified
   - Remediation plan
   - Conditions for approval

8. Conclusion
   - Validation decision
   - Approval/rejection recommendation
   - Next validation date

SECTION 5: IMPLEMENTATION IN PYTHON – MODEL GOVERNANCE DASHBOARD

python
# ===================================================================
# MODULE 8, LESSON 4: MODEL GOVERNANCE AND COMPLIANCE
# ===================================================================

import numpy as np
import pandas as pd
import matplotlib.pyplot as plt
import seaborn as sns
from datetime import datetime, timedelta
import json
import warnings
warnings.filterwarnings('ignore')

# Set style
sns.set_style("whitegrid")
np.random.seed(42)

print("="*70)
print("MODEL GOVERNANCE AND COMPLIANCE IN FINANCIAL SERVICES")
print("="*70)

# ----------------------------------------------------------------
# PART A: MODEL INVENTORY
# ----------------------------------------------------------------

print("\n" + "-"*60)
print("PART A: Model Inventory")
print("-"*60)

# Generate model inventory
def generate_model_inventory(n_models=20):
    """Generate a synthetic model inventory."""
    model_types = ['Credit Scoring', 'Fraud Detection', 'AML', 'Marketing', 'Risk', 
                   'Pricing', 'Customer Churn', 'Collections', 'Stress Testing']
    statuses = ['Development', 'Validation', 'Approved', 'Deployed', 'Monitoring', 'Retired']
    risk_ratings = ['High', 'Medium', 'Low']
    
    models = []
    for i in range(n_models):
        model = {
            'Model ID': f'MOD-{i+1:04d}',
            'Name': f'{np.random.choice(model_types)} Model v{np.random.randint(1,5)}',
            'Type': np.random.choice(model_types),
            'Owner': f'Team {np.random.choice(["Credit", "Risk", "Fraud", "Marketing", "Operations"])}',
            'Status': np.random.choice(statuses, p=[0.1, 0.15, 0.15, 0.2, 0.3, 0.1]),
            'Risk Rating': np.random.choice(risk_ratings, p=[0.3, 0.5, 0.2]),
            'Development Date': (datetime(2024, 1, 1) + timedelta(days=np.random.randint(0, 365))).strftime('%Y-%m-%d'),
            'Last Validation': (datetime(2024, 1, 1) + timedelta(days=np.random.randint(0, 365))).strftime('%Y-%m-%d'),
            'Next Validation': (datetime(2024, 12, 31) + timedelta(days=np.random.randint(0, 365))).strftime('%Y-%m-%d'),
            'Performance AUC': np.round(np.random.uniform(0.70, 0.92), 3),
            'Compliance Status': np.random.choice(['Pass', 'Pass with Conditions', 'Fail'], p=[0.6, 0.3, 0.1]),
            'Validation Finding Count': np.random.randint(0, 8)
        }
        models.append(model)
    
    return pd.DataFrame(models)

inventory_df = generate_model_inventory(20)
print("Model Inventory (sample):")
print(inventory_df.head(10).to_string(index=False))

# ----------------------------------------------------------------
# PART B: MODEL STATUS DASHBOARD
# ----------------------------------------------------------------

print("\n" + "-"*60)
print("PART B: Model Status Dashboard")
print("-"*60)

# Visualise model status
fig, axes = plt.subplots(2, 2, figsize=(14, 10))

# Status distribution
ax = axes[0, 0]
status_counts = inventory_df['Status'].value_counts()
ax.pie(status_counts.values, labels=status_counts.index, autopct='%1.0f%%', colors=sns.color_palette('Set3'))
ax.set_title('Model Status Distribution')

# Risk rating distribution
ax = axes[0, 1]
risk_counts = inventory_df['Risk Rating'].value_counts()
colors = {'High': 'red', 'Medium': 'orange', 'Low': 'green'}
ax.bar(risk_counts.index, risk_counts.values, color=[colors.get(r, 'blue') for r in risk_counts.index])
ax.set_xlabel('Risk Rating')
ax.set_ylabel('Number of Models')
ax.set_title('Model Risk Rating Distribution')
ax.grid(True, alpha=0.3)

# Performance distribution
ax = axes[1, 0]
ax.hist(inventory_df['Performance AUC'], bins=10, edgecolor='black', alpha=0.7, color='blue')
ax.axvline(x=0.75, color='orange', linestyle='--', label='Acceptable (0.75)')
ax.axvline(x=0.80, color='green', linestyle='--', label='Good (0.80)')
ax.set_xlabel('AUC')
ax.set_ylabel('Number of Models')
ax.set_title('Model Performance Distribution')
ax.legend()
ax.grid(True, alpha=0.3)

# Validation due dates
ax = axes[1, 1]
validation_status = []
for _, row in inventory_df.iterrows():
    next_val = datetime.strptime(row['Next Validation'], '%Y-%m-%d')
    days_until = (next_val - datetime.now()).days
    if days_until < 30:
        status = 'Due Soon'
    elif days_until < 90:
        status = 'Approaching'
    else:
        status = 'OK'
    validation_status.append(status)

ax.bar(inventory_df['Model ID'], np.ones(len(inventory_df)), 
       color=['red' if s == 'Due Soon' else 'orange' if s == 'Approaching' else 'green' for s in validation_status])
ax.set_xlabel('Model ID')
ax.set_ylabel('Validation Status')
ax.set_title('Validation Due Dates')
plt.xticks(rotation=45)

plt.tight_layout()
plt.savefig('model_governance_dashboard.png', dpi=300, bbox_inches='tight')
plt.show()
print("Governance dashboard saved as 'model_governance_dashboard.png'")

# ----------------------------------------------------------------
# PART C: MODEL DOCUMENTATION TEMPLATE
# ----------------------------------------------------------------

print("\n" + "-"*60)
print("PART C: Model Documentation Template")
print("-"*60)

def generate_model_card(model_data):
    """Generate a model card from model metadata."""
    
    model_card = f"""
--- MODEL CARD ---

1. MODEL DETAILS
   - Model Name: {model_data.get('Name', 'Credit Scoring Model')}
   - Model ID: {model_data.get('Model ID', 'MOD-0000')}
   - Model Type: {model_data.get('Type', 'Credit Risk')}
   - Version: {model_data.get('Version', '1.0')}
   - Owner: {model_data.get('Owner', 'Credit Risk Team')}
   - Development Date: {model_data.get('Development Date', '2024-01-01')}
   - Risk Rating: {model_data.get('Risk Rating', 'Medium')}

2. INTENDED USE
   - Primary Use: {model_data.get('Primary Use', 'Predict probability of default')}
   - Secondary Use: {model_data.get('Secondary Use', 'Portfolio risk assessment')}
   - Out-of-Scope: {model_data.get('Out of Scope', 'Automated lending decisions without human review')}

3. DATA
   - Training Data Period: {model_data.get('Training Period', '2020-2023')}
   - Features: {model_data.get('Features', 'income, dti, credit_score, loan_amount, employment_years, age')}
   - Target: {model_data.get('Target', 'Default (0/1)')}
   - Sample Size: {model_data.get('Sample Size', '50,000')}
   - Default Rate: {model_data.get('Default Rate', '4.2%')}

4. PERFORMANCE (Validation)
   - AUC: {model_data.get('Performance AUC', 0.82)}
   - KS Statistic: {model_data.get('KS Statistic', 0.38)}
   - Gini Coefficient: {model_data.get('Gini', 0.64)}
   - Accuracy: {model_data.get('Accuracy', 0.79)}
   - Calibration (H-L): {model_data.get('Calibration', 'p=0.12')}

5. FAIRNESS
   - Protected Attributes Considered: {model_data.get('Protected Attributes', 'Age, Gender, Race (proxy)')}
   - Disparate Impact Ratio: {model_data.get('Disparate Impact', '0.85')}
   - Compliance Status: {model_data.get('Compliance Status', 'Pass')}

6. GOVERNANCE
   - Model Owner: {model_data.get('Owner', 'Credit Risk Team')}
   - Validator: {model_data.get('Validator', 'Model Validation Team')}
   - Approval Date: {model_data.get('Approval Date', '2024-06-15')}
   - Review Frequency: {model_data.get('Review Frequency', 'Annual')}
   - Next Validation: {model_data.get('Next Validation', '2025-06-15')}

7. LIMITATIONS
   - {model_data.get('Limitation 1', 'Model may not perform well during severe economic downturns.')}
   - {model_data.get('Limitation 2', 'Limited data on certain customer segments.')}
   - {model_data.get('Limitation 3', 'Not validated for use with alternative data.')}

8. ETHICAL CONSIDERATIONS
   - {model_data.get('Ethical Consideration 1', 'Potential for bias through proxy variables.')}
   - {model_data.get('Ethical Consideration 2', 'Regular monitoring for disparate impact.')}
   - {model_data.get('Ethical Consideration 3', 'Human review for all rejected applications.')}
"""
    return model_card

# Example model card
sample_model = {
    'Name': 'Credit Scoring Model v3.2',
    'Model ID': 'MOD-0001',
    'Type': 'Credit Scoring',
    'Version': '3.2',
    'Owner': 'Credit Risk Analytics',
    'Primary Use': 'Predict probability of default for unsecured loans',
    'Performance AUC': 0.85,
    'KS Statistic': 0.42,
    'Gini': 0.70,
    'Accuracy': 0.81,
    'Calibration': 'p=0.18',
    'Disparate Impact': '0.88',
    'Compliance Status': 'Pass',
    'Approval Date': '2024-06-15',
    'Review Frequency': 'Annual',
    'Next Validation': '2025-06-15'
}

print("Model Card Sample:")
print(generate_model_card(sample_model))

# ----------------------------------------------------------------
# PART D: COMPLIANCE CHECKLIST
# ----------------------------------------------------------------

print("\n" + "-"*60)
print("PART D: Model Compliance Checklist")
print("-"*60)

compliance_checklist = pd.DataFrame({
    'Requirement': [
        'Model documentation is complete and approved',
        'Data lineage and quality documented',
        'Model validation completed and approved',
        'Performance metrics meet thresholds',
        'Fairness testing completed (disparate impact)',
        'Explainability methods implemented (SHAP/LIME)',
        'Monitoring dashboard in place',
        'Retraining strategy documented',
        'Incident response plan in place',
        'Regulatory approvals obtained',
        'User training completed',
        'Model inventory updated'
    ],
    'Status': np.random.choice(['✅ Complete', '🟡 In Progress', '❌ Not Started'], 12, p=[0.5, 0.3, 0.2]),
    'Owner': [
        'Product Owner', 'Data Team', 'Validation Team', 'Data Science',
        'Data Science', 'Data Science', 'MLOps', 'MLOps', 'Risk Team',
        'Compliance', 'Training Team', 'Governance'
    ],
    'Due Date': [(datetime(2024, 1, 1) + timedelta(days=np.random.randint(0, 90))).strftime('%Y-%m-%d') for _ in range(12)]
})

print("Compliance Checklist:")
print(compliance_checklist.to_string(index=False))

# ----------------------------------------------------------------
# PART E: VALIDATION SCHEDULE
# ----------------------------------------------------------------

print("\n" + "-"*60)
print("PART E: Validation Schedule")
print("-"*60)

validation_schedule = pd.DataFrame({
    'Model ID': [f'MOD-{i+1:04d}' for i in range(10)],
    'Model Name': [f'Model {i+1}' for i in range(10)],
    'Risk Rating': np.random.choice(['High', 'Medium', 'Low'], 10, p=[0.3, 0.5, 0.2]),
    'Last Validation': [(datetime(2023, 1, 1) + timedelta(days=np.random.randint(0, 365))).strftime('%Y-%m-%d') for _ in range(10)],
    'Next Validation': [(datetime(2024, 6, 1) + timedelta(days=np.random.randint(0, 180))).strftime('%Y-%m-%d') for _ in range(10)],
    'Days Until Due': [np.random.randint(10, 150) for _ in range(10)],
    'Status': np.random.choice(['On Track', 'At Risk', 'Overdue'], 10, p=[0.6, 0.2, 0.2])
})

print("Validation Schedule:")
print(validation_schedule.to_string(index=False))

# ----------------------------------------------------------------
# PART F: INCIDENT MANAGEMENT
# ----------------------------------------------------------------

print("\n" + "-"*60)
print("PART F: Incident Management")
print("-"*60)

incidents = pd.DataFrame({
    'Incident ID': [f'INC-{i+1:04d}' for i in range(8)],
    'Model ID': [f'MOD-{np.random.randint(1, 20):04d}' for _ in range(8)],
    'Date': [(datetime(2024, 1, 1) + timedelta(days=np.random.randint(0, 30))).strftime('%Y-%m-%d') for _ in range(8)],
    'Type': np.random.choice(['Performance Drop', 'Data Drift', 'Security Issue', 'Compliance Violation', 'SLA Breach'], 8),
    'Priority': np.random.choice(['Critical', 'High', 'Medium', 'Low'], 8, p=[0.1, 0.3, 0.4, 0.2]),
    'Status': np.random.choice(['Open', 'Investigating', 'Mitigated', 'Closed'], 8, p=[0.2, 0.2, 0.3, 0.3]),
    'Resolution': np.random.choice(['Retraining', 'Model Rollback', 'Threshold Adjustment', 'Data Fix', 'None'], 8)
})

print("Incident Register:")
print(incidents.to_string(index=False))

# ----------------------------------------------------------------
# PART G: REGULATORY SUBMISSION CHECKLIST
# ----------------------------------------------------------------

print("\n" + "-"*60)
print("PART G: Regulatory Submission Checklist")
print("-"*60)

regulatory_checklist = {
    "SR 11-7": [
        "Model development documentation",
        "Model validation report (independent)",
        "Model monitoring report (ongoing)",
        "Model inventory with risk ratings",
        "Board-level model governance",
        "Model change management process"
    ],
    "BCBS 239": [
        "Data quality framework",
        "Data lineage documentation",
        "Data quality metrics and monitoring",
        "Data governance structure",
        "Data quality issue resolution process"
    ],
    "EU AI Act (High-Risk)": [
        "Conformity assessment",
        "Risk management system",
        "Technical documentation",
        "Transparency and explainability",
        "Human oversight",
        "Accuracy, robustness, cybersecurity"
    ],
    "Fair Lending (ECOA)": [
        "Disparate impact testing",
        "Protected attribute analysis",
        "Fairness metrics documentation",
        "Regular monitoring and reporting"
    ]
}

for reg, items in regulatory_checklist.items():
    print(f"\n{reg}:")
    for item in items:
        print(f"  ✓ {item}")

# ----------------------------------------------------------------
# PART H: SUMMARY AND RECOMMENDATIONS
# ----------------------------------------------------------------

print("\n" + "="*70)
print("PART H: Summary and Recommendations")
print("="*70)

print("""
Model Governance and Compliance – Key Takeaways:

1. Regulatory Landscape: SR 11-7, BCBS 239, EU AI Act, GDPR, Fair Lending.
2. Governance Framework: Model inventory, lifecycle, risk rating, approval workflows.
3. Model Validation: Independent review; conceptual soundness, data quality, performance.
4. Documentation: Model cards, validation reports, monitoring reports.
5. Fairness: Disparate impact testing; protected attribute analysis.
6. Monitoring: Performance tracking; drift detection; incident management.
7. Lifecycle: Planning → Development → Validation → Approval → Deployment → Monitoring → Retirement.

Recommendations:
  - Establish a centralised model inventory and governance system.
  - Implement a standardised model documentation process (model cards).
  - Conduct independent validation for all high-risk models.
  - Develop a monitoring framework with clear triggers and escalation.
  - Engage with compliance and legal teams early.
  - Build a culture of governance and accountability.
  - Regularly review and update governance policies.
""")

print("="*70)
print("END OF LESSON 4 – MODULE 8")
print("="*70)

SECTION 6: SUMMARY FOR THE DATA PRACTITIONER

  • Model governance is a regulatory requirement, not an optional practice.

  • SR 11-7 provides the gold standard for model risk management in banking.

  • Model inventory, validation, documentation, and monitoring are the pillars of governance.

  • Risk ratings (High/Medium/Low) determine validation frequency and oversight.

  • Model cards provide a standardised way to document model information.

  • Fairness testing is essential for regulatory compliance and ethical AI.

  • Incident management ensures swift response to model issues.


SECTION 7: RECOMMENDED NEXT STEPS

  1. Develop a model inventory for your organisation’s models.

  2. Create model cards for your existing models.

  3. Implement a validation schedule aligned with risk ratings.

  4. Establish a model governance committee or working group.

  5. Build a monitoring dashboard for model performance and compliance.

  6. Prepare for the next lesson on Communication and Stakeholder Management.