Strategic, reputational and model risk · RiskAtoms Academy

By the end you will be able to

1Explain strategic and business risk, and why they sit outside operational risk.
2Explain reputational risk, and why it usually amplifies another event.
3Explain model risk and why it is managed as a risk in its own right.
4Describe the main defences against model risk: inventory, validation and effective challenge.

Why it matters

In 2012 JPMorgan lost more than $6 billion on a trading book its risk model said was getting safer. One of the reasons, its own review found, was an error in a spreadsheet formula.

Core explanation

Risks that no balance sheet line shows

The Basel definition of operational risk leaves out strategic and reputational risk (L2.2.05: Operational risk). Model risk is sometimes filed under operational risk and sometimes on its own. All three come from decisions and trust rather than from positions, which is why they barely show on Example Group's balance sheets (L2.2.01: A map of risk types).

Strategic risk. Strategic risk is the risk of choosing the wrong businesses, or running them the wrong way: an acquisition at the top of the market, a late move to digital banking, a bet on a product that regulators then restrict. A close cousin, business risk, is the plain risk that income falls or costs rise without any single loss event. Both are owned by the board and the executive team, and measured with business plans and earnings stress tests rather than daily numbers.

Reputational risk. Reputational risk is the risk that people stop trusting the firm, and take their business or money elsewhere. It rarely starts on its own: it follows misconduct, a fraud, a data breach or a big loss, and multiplies the cost. For a bank, lost trust can become a liquidity problem within days (L2.2.04: Liquidity risk). It is hard to measure, so firms manage it through conduct rules, complaints data and careful choices about whom they do business with.

Model risk. Finance runs on models: to price derivatives, rate borrowers, set provisions, measure market risk, calculate capital, spot money laundering. The US Federal Reserve and OCC define model risk as the potential for adverse consequences from decisions based on incorrect or misused model outputs. It has two sources: the model is wrong (bad data, flawed theory, coding errors), or the model is right but used wrongly (outside the conditions it was built for, or without understanding its limits).

Why model risk is a risk in its own right

Models measure the other risks. If the market risk model is wrong, market risk reports look calm while losses build. The model's error is not part of the risk it measures; it is a separate risk on top.
Errors are silent. A wrong number looks like a right one. Nothing breaks; decisions quietly get worse.
One model, many decisions. A PD model sets prices, provisions and capital for thousands of loans at once, so one flaw spreads everywhere.
It needs its own defences: a model inventory, risk tiers, independent validation and effective challenge. No other risk function provides these.

ExploreWhere a model can go wrong

Click each stage of a model's life to see a typical failure and its control.

Data

A credit model trained only on boom years has never seen a recession, so it underestimates defaults. Control: check the data covers the conditions the model will face.

Sort itStrategic, reputational or model?

The group buys a rival at a record price just before a downturn, then writes off much of the goodwill.
Newspapers reveal that the bank lent to a company linked to sanctions evasion. Several large clients move their accounts.
An IFRS 9 provisioning model built before high inflation underestimates defaults when prices rise.
An AI chatbot gives customers wrong information about their loan terms.
The insurer decides to exit motor insurance, then finds its fixed costs cannot be cut as fast as premiums fall.

ExploreExample Group: where the risks sit

Pick a risk type to light up the lines that carry it. Pick a line to see why.

Example Bank plc

£ billions · assets carrying model risk: £0bn (0%)

Assets

Liabilities

Example Insurance SE

€ millions · assets carrying model risk: €0m (0%)

Assets

Liabilities

Model risk

The risk of loss from decisions based on models that are wrong or used wrongly.

No line carries it. It comes from how the group is run, not from what it holds. Its losses still reach equity in the end.

Where this goes next

M3.6: Operational and non-financial risk introduces model risk alongside other non-financial risks, and M5.8: Model risk, validation and machine learning covers model risk management, validation and AI models in depth. Strategic and reputational risk return in Pillar 2 and stress testing (M4.9: Supervision, stress testing and disclosure) and in enterprise risk management (M6.1: Enterprise risk and economic capital).

The formal version

The volatility the model should measure

The Try it below measures the daily volatility of a credit spread. Each day's relative change divides the move by the average level of the two days, and the volatility is the sample standard deviation of the changes, dividing by $n-1$ because it is estimated from data:

r_t = \frac{s_t - s_{t-1}}{(s_t + s_{t-1})/2}, \qquad \sigma = \sqrt{\frac{1}{n-1}\sum_{t=1}^{n} (r_t - \bar r)^2}

Drop the “/2” by mistake and every $r_t$ is halved, so $\sigma$ is halved too. The formula still looks reasonable; only an independent check of the code would find it.

Try it

A desk holds a £2,000m credit position, with a risk limit of £50m measured as position × daily volatility. With the correct formula the risk is £69.4m, a breach. With the slip it is £34.7m, comfortably inside. Switch between them.

Try itOne slip in a risk model

Each day's change is divided by…

Day	Spread (bp)	Relative change
0	100
1	103	2.96%
2	101	-1.96%
3	106	4.83%
4	104	-1.90%
5	109	4.69%
6	112	2.71%
7	108	-3.64%
8	113	4.52%
9	118	4.33%
10	115	-2.58%

Illustrative data.

Daily volatility (sample standard deviation, n − 1)3.47%

Risk on the £2,000m position£69.4m

Risk limit£50.0m

Limit breached. The desk must cut the position.

This is the correct measure. Now switch to the sum and see what one slip in a formula does.

Worked example

Applying SR 11-7 to a new credit model

Example Bank plc's small business team builds a new model to approve loans. Follow the model risk framework before it goes live.

From build to approval

Step 1 of 5

1
Register it
The model goes into the inventory with an owner, a stated purpose and the decisions it drives.

Regulatory lens

United States: SR 11-7, Supervisory Guidance on Model Risk Management, issued by the Federal Reserve and the OCC in April 2011, set the standard: sound development, independent validation and governance, with effective challenge throughout.
United Kingdom: the PRA's SS1/23, Model risk management principles for banks (May 2023, in force from May 2024), sets five principles: model identification and risk classification; governance; development, implementation and use; independent validation; and risk mitigants.
Strategic and reputational risk have no Pillar 1 capital charge. Banks must assess them in their own capital assessment under Pillar 2, and supervisors review it.

Pillar 2 and supervisory review are covered in M4.9: Supervision, stress testing and disclosure.

Sparks

SparkThe London Whale's spreadsheet

JPMorgan's 2013 task force report on its 2012 trading losses found that a new value-at-risk model had been run partly through spreadsheets copied and pasted by hand. One formula divided by the sum of two rates instead of their average, which muted the measured volatility. Model risk and operational risk met in a single cell.

SparkFake accounts, real damage

In 2016 US regulators fined Wells Fargo after staff, pushed by sales targets, had opened accounts customers had not asked for. The fines were the smaller cost. In 2018 the Federal Reserve barred the bank from growing its balance sheet until it fixed its governance, a cap that lasted for years.

Key takeaways

Strategic risk: wrong choices or a changing market; owned by the board, measured with plans and stress tests.
Reputational risk: lost trust that costs business or funding; it usually amplifies another event.
Model risk: decisions based on wrong or misused model outputs. Two sources: the model is wrong, or it is used wrongly.
Model risk is a risk in its own right because models measure the other risks, their errors are silent, and they spread.
The defences: inventory, tiering, independent validation and effective challenge. A 50% understatement can hide in one formula.

Reaction

Check what stuck

Glossary

Strategic risk: The risk that the firm's plans or business model fail: wrong choices, poor execution, or a market that changes around it.
Business risk: The risk that earnings fall because volumes, margins or costs move against the firm, without any one loss event.
Reputational risk: The risk that a loss of trust among customers, investors, staff or regulators costs the firm business or funding.
Model: A quantitative method that turns data and assumptions into estimates, such as a price, a PD or a risk number.
Model risk: The potential for adverse consequences from decisions based on incorrect or misused model outputs and reports.
Model inventory: A complete list of a firm's models, with their owners, uses and risk tier.
Model tier: A ranking of models by how much harm an error could do, which sets how closely each is validated.
Model validation: An independent check that a model is sound, works as intended and is used within its limits.
Effective challenge: Critical review by people who are independent, competent and have the authority to force changes.
Overlay: An adjustment added to a model's output by judgement, to cover a known weakness until it is fixed.

Deep Dives & Origins

Deep Dives

JPMorgan Chase, Report of JPMorgan Chase & Co. Management Task Force Regarding 2012 CIO Losses, January 2013. Intermediate.
Morini, Understanding and Managing Model Risk: A Practical Guide for Quants, Traders and Validators (Wiley, 2011). Advanced.

Origins

Board of Governors of the Federal Reserve System and OCC, SR 11-7 / OCC 2011-12, Supervisory Guidance on Model Risk Management, April 2011.
Prudential Regulation Authority, SS1/23 Model risk management principles for banks, May 2023.
BCBS, Enhancements to the Basel II framework, July 2009 (Pillar 2 and reputational risk).
US Senate Permanent Subcommittee on Investigations, JPMorgan Chase Whale Trades: A Case History of Derivatives Risks and Abuses, March 2013.
Board of Governors of the Federal Reserve System, press release on Wells Fargo enforcement action, February 2018.

Watch this lesson

Video version

Prefer to watch? The same lesson as a 10-minute video will sit here, made from this page's script.