Pim Poppe en Erik Kooistra: AFM Good Practice on model risk management deserves attention
By Pim Poppe (Managing Partner) & Erik Kooistra (Service Line Lead Modelvalidatie), Probability & Partners
The AFM document is based on an exploratory study involving a questionnaire among asset managers. The AFM assessed current market practice and distilled good practices from it. Notably, the AFM refers to “good practices” rather than “best practices”, which we interpret as recognition that there is room for further improvement: this is a strong first step towards mature model risk management.
The AFM Good Practices in brief
If we reduce the AFM document to its essence, the good practices can be summarised as follows:
- GP1. Establish a dedicated governance structure for model risk:
Formalise responsibilities for model development, implementation, maintenance, validation, change management and decommissioning. Organise these in line with the Three Lines model and, depending on model complexity and the nature of the asset manager, consider setting up a model governance committee. - GP2. Implement a model definition to support a common understanding:
Define clearly what constitutes a model (e.g. inputs, processing, outputs used in decision‑making), document and communicate this definition, and determine the scope of model risk management. - GP3. Define risk appetite and Key Risk Indicators (KRIs) to support model risk management:
Document the model risk appetite, translate this into KRIs (e.g. number of non‑validated models or outstanding findings), establish monitoring processes and align controls with the risk appetite. - GP4. Create a model inventory as an integral part of model risk management:
Maintain a central inventory including model ID, purpose, owner, risk classification, lifecycle status and last validation date. Use this inventory as the hub for oversight. - GP5. Validate models prior to implementation and ensure periodic revalidation:
Formalise an independent validation process, requiring validation before first use and periodically thereafter (aligned with risk level), performed by someone independent from model development or use. - GP6. Implement a full model lifecycle process:
Define stages from initiation to decommissioning, including clear roles, controls, documentation, change management and formal retirement to ensure models remain up to date. - GP7. Apply model risk management principles to both internal and third‑party models:
Apply the same principles to external models, obtain documentation (e.g. validation reports, assumptions), engage with vendors and ensure robust third‑party risk management. - GP8. Promote internal knowledge and expertise on models and model risk:
Develop and maintain knowledge through training, documentation and knowledge sharing, and distribute expertise widely to reduce key‑person risk.
Relevance for our own company
For several years we have presented a model risk management framework to pension funds and asset managers, aiming for a ‘middle ground’ between the highly detailed regulatory expectations and strict on‑site supervision for banks and insurers, and the more relaxed approach commonly seen among pension funds and asset managers. The AFM’s recommendations align closely with our ‘middle‑ground’ model risk management solution. We will therefore continue referring to the AFM good practices in our discussions with asset managers and pension funds.
In addition to the AFM, DNB has also recently published good practice papers on MRM, specifically in the context of the WTP transition within the pension sector.
Relevance for asset managers
The Good Practices are logical, pragmatic, not excessively prescriptive, and beneficial for both clients and asset managers. We consider it highly advisable to implement these good practices. It is also wise to demonstrate compliance by having the model risk management framework assessed — either by internal audit or, even more convincingly, by an external party.
Relevance for pension funds and other asset owners
As noted above, model errors at an asset manager can result in losses for the asset owner, such as a pension fund. The AFM’s recommendations are reasonable, and pension funds may therefore expect their asset managers to have implemented them. Consequently, it is logical — and required under the WTP transition — that pension funds question their asset managers on model risk control, using the AFM good practices as a reference.
Additional observations on the AFM MRM Good Practices: The importance of documentation:
In our experience, particularly regarding GP8 on internal knowledge and expertise, improvements are often needed. Knowledge is fragmented, and documentation is incomplete, outdated or missing altogether. This creates key‑person risk in model development, validation and use. Staff turnover in these functions is not uncommon, and poor documentation compounds the problem. A first solution, in our view, is to introduce a standardised model documentation template to ensure a minimum level of quality. Responsibility for producing this documentation lies with model developers; validation teams should review and test it.
Client relationship and insurance considerations:
The AFM document pays limited attention to the client’s interest, the asset manager’s liability risk, and the role of insurance in model risk management. Asset managers have a duty of care towards clients and may be held liable for operational errors. A model error or misuse of a model is considered an operational error. Such an error can trigger client claims, which can escalate significantly. Asset managers are often lightly capitalised relative to assets under management, so disputes arise over whether losses should be borne by the asset manager or the asset owner.
Errors may sometimes be covered by an E&O (Errors & Omissions) professional liability insurance policy, but claims are not guaranteed to be accepted and successful claims may lead to higher premiums.
For this reason, model risk appetite (GP3) and risk classification (GP4) should consider liability exposure, insurance coverage and the extent to which insurance should be relied upon. Distinguishing between valuation models, risk models, hedging models and forecasting/allocation models is important for model risk classification and defining risk appetite.
Final note
It is encouraging to see both the AFM and DNB paying increasing attention to model risk management. This supports the quality and maturity of model use within pension funds and asset managers. Ultimately, both institutions and their clients benefit. The AFM’s good practices are logical, pragmatic and not unnecessarily prescriptive. We strongly recommend implementing them and demonstrating alignment in both design and practice, for example through external assessment.
Click here for more columns of Pim Poppe