SECTION 1: LEARNING OBJECTIVES
By the end of this lesson, you will be able to:
-
Understand the regulatory landscape for AI and model governance in banking.
-
Develop a model governance framework aligned with SR 11-7, BCBS 239, and EU AI Act.
-
Implement a model inventory and lifecycle management system.
-
Conduct model validation – independent review, benchmarking, and stress testing.
-
Apply explainability and fairness requirements to ensure regulatory compliance.
-
Manage model risk – identification, assessment, mitigation, and monitoring.
-
Develop model documentation standards for regulatory submissions.
-
Implement model approval workflows – from development to retirement.
-
Use Python to create a model governance dashboard tracking model status, validation, and compliance.
SECTION 2: THE REGULATORY LANDSCAPE
2.1 Key Regulations for AI and Models in Banking
| Regulation | Scope | Key Requirements |
|---|---|---|
| SR 11-7 | US banking (all models) | Model validation, documentation, independent review, ongoing monitoring. |
| BCBS 239 | Risk data aggregation and reporting | Data quality, lineage, timeliness, accuracy. |
| EU AI Act | High-risk AI systems | Conformity assessments, transparency, human oversight. |
| GDPR | Data protection and privacy | Right to explanation, data minimisation, privacy by design. |
| ECOA / FHA | Fair lending | No discrimination; disparate impact testing. |
| Basel III | Capital adequacy | Internal model governance and validation. |
| IFRS 9 / CECL | Expected credit loss | Model validation and calibration. |
2.2 SR 11-7 – The Gold Standard
SR 11-7 (Supervisory Guidance on Model Risk Management) is the primary regulatory guidance for model governance in US banking.
Key Pillars:
| Pillar | Description | Activities |
|---|---|---|
| Model Development | Models must be conceptually sound. | Clear documentation; theoretical basis; data validation. |
| Model Validation | Independent review of models. | Conceptual soundness; data quality; performance testing. |
| Model Monitoring | Ongoing performance tracking. | Performance metrics; drift detection; trigger-based review. |
| Governance | Oversight and accountability. | Model inventory; approval workflows; risk rating. |
The Three Lines of Defence:
-
1st Line: Model development and implementation.
-
2nd Line: Independent model validation.
-
3rd Line: Internal audit.
SECTION 3: MODEL GOVERNANCE FRAMEWORK
3.1 Components of a Model Governance Framework
| Component | Description | Implementation |
|---|---|---|
| Model Inventory | Centralised repository of all models. | Database with model metadata, owner, status, risk rating. |
| Model Lifecycle | From development to retirement. | Stages: Planning → Development → Validation → Approval → Deployment → Monitoring → Retirement. |
| Risk Rating | Assess model risk level. | High/Medium/Low based on impact, complexity, and materiality. |
| Approval Workflow | Sign-off process for each stage. | Development → Validation → Business Approval → Deployment. |
| Documentation | Comprehensive model documentation. | Model card, validation report, monitoring report. |
| Validation | Independent model review. | Annual validation; trigger-based revalidation. |
| Monitoring | Ongoing performance tracking. | Monthly/quarterly performance reports. |
| Retirement | Decommissioning models. | Transition plan; archiving; final validation. |
3.2 Model Risk Rating
| Risk Level | Characteristics | Validation Frequency | Escalation |
|---|---|---|---|
| High | Material impact; complex; new methodology. | Annual; trigger-based. | Steering Committee. |
| Medium | Moderate impact; established methodology. | 18-24 months. | Model Risk Committee. |
| Low | Low impact; simple; well-understood. | 2-3 years. | Department head. |
3.3 Model Lifecycle Stages
┌──────────────┐ ┌──────────────┐ ┌──────────────┐ ┌──────────────┐
│ Planning │ → │ Development │ → │ Validation │ → │ Approval │
│ (Business │ │ (Data, │ │ (Independent│ │ (Steering │
│ Need) │ │ Features) │ │ Review) │ │ Committee) │
└──────────────┘ └──────────────┘ └──────────────┘ └──────────────┘
│
v
┌──────────────┐ ┌──────────────┐ ┌──────────────┐ ┌──────────────┐
│ Retirement │ ← │ Monitoring │ ← │ Deployment │ ← │ Approval │
│ (Decommission│ │ (Performance│ │ (Production) │ │ (Readiness) │
│ Model) │ │ Tracking) │ │ │ │ │
└──────────────┘ └──────────────┘ └──────────────┘ └──────────────┘
SECTION 4: MODEL VALIDATION
4.1 Validation Activities
| Activity | Description | Tools/Methods |
|---|---|---|
| Conceptual Soundness | Review theoretical basis and methodology. | Literature review; peer review. |
| Data Quality | Assess data accuracy, completeness, and timeliness. | Data profiling; lineage tracking. |
| Performance Testing | Evaluate model accuracy and stability. | AUC, KS, calibration; backtesting. |
| Benchmarking | Compare with alternative models. | Simpler models; industry benchmarks. |
| Sensitivity Analysis | Test model response to input changes. | Scenario analysis; stress testing. |
| Stability Testing | Test model performance over time. | Out-of-time testing; rolling windows. |
| Fairness Testing | Test for disparate impact. | Demographic parity; equal opportunity. |
4.2 Validation Report Structure
--- MODEL VALIDATION REPORT --- 1. Executive Summary - Model overview - Validation findings - Recommendations and decision 2. Model Overview - Model name and version - Owner and developer - Intended use and limitations - Methodology 3. Data Quality Assessment - Data sources and lineage - Data completeness and accuracy - Data transformations 4. Performance Assessment - AUC, KS, Gini coefficient - Calibration (Hosmer-Lemeshow) - Backtesting results 5. Robustness Testing - Sensitivity analysis - Stress testing - Benchmarking 6. Fairness Assessment - Disparate impact testing - Protected attribute analysis 7. Findings and Recommendations - Issues identified - Remediation plan - Conditions for approval 8. Conclusion - Validation decision - Approval/rejection recommendation - Next validation date
SECTION 5: IMPLEMENTATION IN PYTHON – MODEL GOVERNANCE DASHBOARD
# =================================================================== # MODULE 8, LESSON 4: MODEL GOVERNANCE AND COMPLIANCE # =================================================================== import numpy as np import pandas as pd import matplotlib.pyplot as plt import seaborn as sns from datetime import datetime, timedelta import json import warnings warnings.filterwarnings('ignore') # Set style sns.set_style("whitegrid") np.random.seed(42) print("="*70) print("MODEL GOVERNANCE AND COMPLIANCE IN FINANCIAL SERVICES") print("="*70) # ---------------------------------------------------------------- # PART A: MODEL INVENTORY # ---------------------------------------------------------------- print("\n" + "-"*60) print("PART A: Model Inventory") print("-"*60) # Generate model inventory def generate_model_inventory(n_models=20): """Generate a synthetic model inventory.""" model_types = ['Credit Scoring', 'Fraud Detection', 'AML', 'Marketing', 'Risk', 'Pricing', 'Customer Churn', 'Collections', 'Stress Testing'] statuses = ['Development', 'Validation', 'Approved', 'Deployed', 'Monitoring', 'Retired'] risk_ratings = ['High', 'Medium', 'Low'] models = [] for i in range(n_models): model = { 'Model ID': f'MOD-{i+1:04d}', 'Name': f'{np.random.choice(model_types)} Model v{np.random.randint(1,5)}', 'Type': np.random.choice(model_types), 'Owner': f'Team {np.random.choice(["Credit", "Risk", "Fraud", "Marketing", "Operations"])}', 'Status': np.random.choice(statuses, p=[0.1, 0.15, 0.15, 0.2, 0.3, 0.1]), 'Risk Rating': np.random.choice(risk_ratings, p=[0.3, 0.5, 0.2]), 'Development Date': (datetime(2024, 1, 1) + timedelta(days=np.random.randint(0, 365))).strftime('%Y-%m-%d'), 'Last Validation': (datetime(2024, 1, 1) + timedelta(days=np.random.randint(0, 365))).strftime('%Y-%m-%d'), 'Next Validation': (datetime(2024, 12, 31) + timedelta(days=np.random.randint(0, 365))).strftime('%Y-%m-%d'), 'Performance AUC': np.round(np.random.uniform(0.70, 0.92), 3), 'Compliance Status': np.random.choice(['Pass', 'Pass with Conditions', 'Fail'], p=[0.6, 0.3, 0.1]), 'Validation Finding Count': np.random.randint(0, 8) } models.append(model) return pd.DataFrame(models) inventory_df = generate_model_inventory(20) print("Model Inventory (sample):") print(inventory_df.head(10).to_string(index=False)) # ---------------------------------------------------------------- # PART B: MODEL STATUS DASHBOARD # ---------------------------------------------------------------- print("\n" + "-"*60) print("PART B: Model Status Dashboard") print("-"*60) # Visualise model status fig, axes = plt.subplots(2, 2, figsize=(14, 10)) # Status distribution ax = axes[0, 0] status_counts = inventory_df['Status'].value_counts() ax.pie(status_counts.values, labels=status_counts.index, autopct='%1.0f%%', colors=sns.color_palette('Set3')) ax.set_title('Model Status Distribution') # Risk rating distribution ax = axes[0, 1] risk_counts = inventory_df['Risk Rating'].value_counts() colors = {'High': 'red', 'Medium': 'orange', 'Low': 'green'} ax.bar(risk_counts.index, risk_counts.values, color=[colors.get(r, 'blue') for r in risk_counts.index]) ax.set_xlabel('Risk Rating') ax.set_ylabel('Number of Models') ax.set_title('Model Risk Rating Distribution') ax.grid(True, alpha=0.3) # Performance distribution ax = axes[1, 0] ax.hist(inventory_df['Performance AUC'], bins=10, edgecolor='black', alpha=0.7, color='blue') ax.axvline(x=0.75, color='orange', linestyle='--', label='Acceptable (0.75)') ax.axvline(x=0.80, color='green', linestyle='--', label='Good (0.80)') ax.set_xlabel('AUC') ax.set_ylabel('Number of Models') ax.set_title('Model Performance Distribution') ax.legend() ax.grid(True, alpha=0.3) # Validation due dates ax = axes[1, 1] validation_status = [] for _, row in inventory_df.iterrows(): next_val = datetime.strptime(row['Next Validation'], '%Y-%m-%d') days_until = (next_val - datetime.now()).days if days_until < 30: status = 'Due Soon' elif days_until < 90: status = 'Approaching' else: status = 'OK' validation_status.append(status) ax.bar(inventory_df['Model ID'], np.ones(len(inventory_df)), color=['red' if s == 'Due Soon' else 'orange' if s == 'Approaching' else 'green' for s in validation_status]) ax.set_xlabel('Model ID') ax.set_ylabel('Validation Status') ax.set_title('Validation Due Dates') plt.xticks(rotation=45) plt.tight_layout() plt.savefig('model_governance_dashboard.png', dpi=300, bbox_inches='tight') plt.show() print("Governance dashboard saved as 'model_governance_dashboard.png'") # ---------------------------------------------------------------- # PART C: MODEL DOCUMENTATION TEMPLATE # ---------------------------------------------------------------- print("\n" + "-"*60) print("PART C: Model Documentation Template") print("-"*60) def generate_model_card(model_data): """Generate a model card from model metadata.""" model_card = f""" --- MODEL CARD --- 1. MODEL DETAILS - Model Name: {model_data.get('Name', 'Credit Scoring Model')} - Model ID: {model_data.get('Model ID', 'MOD-0000')} - Model Type: {model_data.get('Type', 'Credit Risk')} - Version: {model_data.get('Version', '1.0')} - Owner: {model_data.get('Owner', 'Credit Risk Team')} - Development Date: {model_data.get('Development Date', '2024-01-01')} - Risk Rating: {model_data.get('Risk Rating', 'Medium')} 2. INTENDED USE - Primary Use: {model_data.get('Primary Use', 'Predict probability of default')} - Secondary Use: {model_data.get('Secondary Use', 'Portfolio risk assessment')} - Out-of-Scope: {model_data.get('Out of Scope', 'Automated lending decisions without human review')} 3. DATA - Training Data Period: {model_data.get('Training Period', '2020-2023')} - Features: {model_data.get('Features', 'income, dti, credit_score, loan_amount, employment_years, age')} - Target: {model_data.get('Target', 'Default (0/1)')} - Sample Size: {model_data.get('Sample Size', '50,000')} - Default Rate: {model_data.get('Default Rate', '4.2%')} 4. PERFORMANCE (Validation) - AUC: {model_data.get('Performance AUC', 0.82)} - KS Statistic: {model_data.get('KS Statistic', 0.38)} - Gini Coefficient: {model_data.get('Gini', 0.64)} - Accuracy: {model_data.get('Accuracy', 0.79)} - Calibration (H-L): {model_data.get('Calibration', 'p=0.12')} 5. FAIRNESS - Protected Attributes Considered: {model_data.get('Protected Attributes', 'Age, Gender, Race (proxy)')} - Disparate Impact Ratio: {model_data.get('Disparate Impact', '0.85')} - Compliance Status: {model_data.get('Compliance Status', 'Pass')} 6. GOVERNANCE - Model Owner: {model_data.get('Owner', 'Credit Risk Team')} - Validator: {model_data.get('Validator', 'Model Validation Team')} - Approval Date: {model_data.get('Approval Date', '2024-06-15')} - Review Frequency: {model_data.get('Review Frequency', 'Annual')} - Next Validation: {model_data.get('Next Validation', '2025-06-15')} 7. LIMITATIONS - {model_data.get('Limitation 1', 'Model may not perform well during severe economic downturns.')} - {model_data.get('Limitation 2', 'Limited data on certain customer segments.')} - {model_data.get('Limitation 3', 'Not validated for use with alternative data.')} 8. ETHICAL CONSIDERATIONS - {model_data.get('Ethical Consideration 1', 'Potential for bias through proxy variables.')} - {model_data.get('Ethical Consideration 2', 'Regular monitoring for disparate impact.')} - {model_data.get('Ethical Consideration 3', 'Human review for all rejected applications.')} """ return model_card # Example model card sample_model = { 'Name': 'Credit Scoring Model v3.2', 'Model ID': 'MOD-0001', 'Type': 'Credit Scoring', 'Version': '3.2', 'Owner': 'Credit Risk Analytics', 'Primary Use': 'Predict probability of default for unsecured loans', 'Performance AUC': 0.85, 'KS Statistic': 0.42, 'Gini': 0.70, 'Accuracy': 0.81, 'Calibration': 'p=0.18', 'Disparate Impact': '0.88', 'Compliance Status': 'Pass', 'Approval Date': '2024-06-15', 'Review Frequency': 'Annual', 'Next Validation': '2025-06-15' } print("Model Card Sample:") print(generate_model_card(sample_model)) # ---------------------------------------------------------------- # PART D: COMPLIANCE CHECKLIST # ---------------------------------------------------------------- print("\n" + "-"*60) print("PART D: Model Compliance Checklist") print("-"*60) compliance_checklist = pd.DataFrame({ 'Requirement': [ 'Model documentation is complete and approved', 'Data lineage and quality documented', 'Model validation completed and approved', 'Performance metrics meet thresholds', 'Fairness testing completed (disparate impact)', 'Explainability methods implemented (SHAP/LIME)', 'Monitoring dashboard in place', 'Retraining strategy documented', 'Incident response plan in place', 'Regulatory approvals obtained', 'User training completed', 'Model inventory updated' ], 'Status': np.random.choice(['✅ Complete', '🟡 In Progress', '❌ Not Started'], 12, p=[0.5, 0.3, 0.2]), 'Owner': [ 'Product Owner', 'Data Team', 'Validation Team', 'Data Science', 'Data Science', 'Data Science', 'MLOps', 'MLOps', 'Risk Team', 'Compliance', 'Training Team', 'Governance' ], 'Due Date': [(datetime(2024, 1, 1) + timedelta(days=np.random.randint(0, 90))).strftime('%Y-%m-%d') for _ in range(12)] }) print("Compliance Checklist:") print(compliance_checklist.to_string(index=False)) # ---------------------------------------------------------------- # PART E: VALIDATION SCHEDULE # ---------------------------------------------------------------- print("\n" + "-"*60) print("PART E: Validation Schedule") print("-"*60) validation_schedule = pd.DataFrame({ 'Model ID': [f'MOD-{i+1:04d}' for i in range(10)], 'Model Name': [f'Model {i+1}' for i in range(10)], 'Risk Rating': np.random.choice(['High', 'Medium', 'Low'], 10, p=[0.3, 0.5, 0.2]), 'Last Validation': [(datetime(2023, 1, 1) + timedelta(days=np.random.randint(0, 365))).strftime('%Y-%m-%d') for _ in range(10)], 'Next Validation': [(datetime(2024, 6, 1) + timedelta(days=np.random.randint(0, 180))).strftime('%Y-%m-%d') for _ in range(10)], 'Days Until Due': [np.random.randint(10, 150) for _ in range(10)], 'Status': np.random.choice(['On Track', 'At Risk', 'Overdue'], 10, p=[0.6, 0.2, 0.2]) }) print("Validation Schedule:") print(validation_schedule.to_string(index=False)) # ---------------------------------------------------------------- # PART F: INCIDENT MANAGEMENT # ---------------------------------------------------------------- print("\n" + "-"*60) print("PART F: Incident Management") print("-"*60) incidents = pd.DataFrame({ 'Incident ID': [f'INC-{i+1:04d}' for i in range(8)], 'Model ID': [f'MOD-{np.random.randint(1, 20):04d}' for _ in range(8)], 'Date': [(datetime(2024, 1, 1) + timedelta(days=np.random.randint(0, 30))).strftime('%Y-%m-%d') for _ in range(8)], 'Type': np.random.choice(['Performance Drop', 'Data Drift', 'Security Issue', 'Compliance Violation', 'SLA Breach'], 8), 'Priority': np.random.choice(['Critical', 'High', 'Medium', 'Low'], 8, p=[0.1, 0.3, 0.4, 0.2]), 'Status': np.random.choice(['Open', 'Investigating', 'Mitigated', 'Closed'], 8, p=[0.2, 0.2, 0.3, 0.3]), 'Resolution': np.random.choice(['Retraining', 'Model Rollback', 'Threshold Adjustment', 'Data Fix', 'None'], 8) }) print("Incident Register:") print(incidents.to_string(index=False)) # ---------------------------------------------------------------- # PART G: REGULATORY SUBMISSION CHECKLIST # ---------------------------------------------------------------- print("\n" + "-"*60) print("PART G: Regulatory Submission Checklist") print("-"*60) regulatory_checklist = { "SR 11-7": [ "Model development documentation", "Model validation report (independent)", "Model monitoring report (ongoing)", "Model inventory with risk ratings", "Board-level model governance", "Model change management process" ], "BCBS 239": [ "Data quality framework", "Data lineage documentation", "Data quality metrics and monitoring", "Data governance structure", "Data quality issue resolution process" ], "EU AI Act (High-Risk)": [ "Conformity assessment", "Risk management system", "Technical documentation", "Transparency and explainability", "Human oversight", "Accuracy, robustness, cybersecurity" ], "Fair Lending (ECOA)": [ "Disparate impact testing", "Protected attribute analysis", "Fairness metrics documentation", "Regular monitoring and reporting" ] } for reg, items in regulatory_checklist.items(): print(f"\n{reg}:") for item in items: print(f" ✓ {item}") # ---------------------------------------------------------------- # PART H: SUMMARY AND RECOMMENDATIONS # ---------------------------------------------------------------- print("\n" + "="*70) print("PART H: Summary and Recommendations") print("="*70) print(""" Model Governance and Compliance – Key Takeaways: 1. Regulatory Landscape: SR 11-7, BCBS 239, EU AI Act, GDPR, Fair Lending. 2. Governance Framework: Model inventory, lifecycle, risk rating, approval workflows. 3. Model Validation: Independent review; conceptual soundness, data quality, performance. 4. Documentation: Model cards, validation reports, monitoring reports. 5. Fairness: Disparate impact testing; protected attribute analysis. 6. Monitoring: Performance tracking; drift detection; incident management. 7. Lifecycle: Planning → Development → Validation → Approval → Deployment → Monitoring → Retirement. Recommendations: - Establish a centralised model inventory and governance system. - Implement a standardised model documentation process (model cards). - Conduct independent validation for all high-risk models. - Develop a monitoring framework with clear triggers and escalation. - Engage with compliance and legal teams early. - Build a culture of governance and accountability. - Regularly review and update governance policies. """) print("="*70) print("END OF LESSON 4 – MODULE 8") print("="*70)
SECTION 6: SUMMARY FOR THE DATA PRACTITIONER
-
Model governance is a regulatory requirement, not an optional practice.
-
SR 11-7 provides the gold standard for model risk management in banking.
-
Model inventory, validation, documentation, and monitoring are the pillars of governance.
-
Risk ratings (High/Medium/Low) determine validation frequency and oversight.
-
Model cards provide a standardised way to document model information.
-
Fairness testing is essential for regulatory compliance and ethical AI.
-
Incident management ensures swift response to model issues.
SECTION 7: RECOMMENDED NEXT STEPS
-
Develop a model inventory for your organisation’s models.
-
Create model cards for your existing models.
-
Implement a validation schedule aligned with risk ratings.
-
Establish a model governance committee or working group.
-
Build a monitoring dashboard for model performance and compliance.
-
Prepare for the next lesson on Communication and Stakeholder Management.