Emerging Risks, Lagging Models

Findings of RMA’s third annual Model Risk Management Survey describe a risk management function expanding in influence and application, yet constrained by understaffing, gaps in expertise, and a lack of critical data necessary to understand and model, in a timely way, the rapidly changing nature of risk. 

Here are some key takeaways from the survey results: 

• Climate risk models are absent or lacking in most banks. While the financial effects of climate change are becoming harder to ignore, 84% of surveyed banks still don’t have models to assess these risks. For banks with climate models, the challenge lies in integrating unpredictable weather events into their scenario planning, a complex task as climate data remains sparse. 

• AI and machine learning pose diverse new risks. Only 44% of banks validate their AI and machine learning models consistently, creating potential gaps in risk management. Some banks are still debating whether AI/ML tools should be treated like traditional models, with concerns that rapid developments in these systems complicate validation processes. 

• Many banks do not use models to enhance cybersecurity. Despite the growing sophistication of cyberattacks, nearly half of banks surveyed do not have models or tools in place to assess cybersecurity risks. Cybersecurity was identified as one of the top risks in RMA’s 2024 CRO Outlook Survey. 

• Vendor transparency remains a challenge. Nearly all banks (97%) reported issues with vendor transparency, with just 3% saying third-party models were explained “very well.” Banks rely on vendor solutions for AI/ML and other tools but often lack sufficient documentation on assumptions and limitations, making it difficult to fully manage the risks associated with these technologies. 

Banks must adapt to a shifting model risk landscape. The 2024 survey reveals that banks are facing new pressures in model risk management, from understaffed validation teams to ongoing challenges with vendor transparency. As risks continue to evolve—especially with the growing use of AI/ML tools and the need to address climate risk—banks will need to refine their processes to manage these emerging challenges effectively. 

Want to dig deeper? Check out our 2023 RMA Journal article “The Challenges of Model Risk Management Oversight of Cybersecurity.”