Mô hình quản lý rủi ro (SR 11-7) và AI

SR 11-7 was issued in April 2011 by the Federal Reserve together with the OCC, and the FDIC adopted it in 2017. It defines a model broadly: a quantitative method, system or approach that applies statistical, economic, financial or mathematical theories to turn input data into quantitative estimates. A model has an input part, a processing part and a reporting part. Model risk comes from two sources: fundamental errors in the model, and using a sound model incorrectly or outside its intended purpose. The guidance rests on three pillars. The first is sound development, implementation and use. The second is validation, which has three core elements: evaluating conceptual soundness, ongoing monitoring (including process verification and benchmarking), and outcomes analysis such as back-testing. The third is governance: board and senior management oversight, written policies, a complete model inventory, and documentation detailed enough that someone unfamiliar with the model could understand how it works. Throughout, the guidance calls for "effective challenge," meaning critical review by people who are objective, informed, competent and influential enough to force changes. Vendor models get no exemption. Banks are expected to get appropriate documentation from vendors. Where proprietary details are withheld, banks should rely more on sensitivity analysis, benchmarking and outcomes testing. A common misconception is that SR 11-7 doesn't reach AI because it predates modern machine learning. Its definition is technology-neutral, and supervisors have treated AI as within scope. Banks usually either classify generative AI tools as models or govern them under a broader AI risk framework that uses the same validation principles. Related references include the OCC's 2021 Comptroller's Handbook booklet on model risk management and the NIST AI Risk Management Framework, released in January 2023. For credit decisions, adverse action notice requirements under the Equal Credit Opportunity Act still apply when the model is complex.