Businesses frequently rely upon models to support investment decisions, ensure accurate financial reporting, perform customer transaction monitoring, support CRM systems, engage in capital stress testing, and more. In 2011, the Office of the Comptroller of the Currency published Supervisory Guidance on Model Risk Management (MRM). Over time, the Securities and Exchange Commission (SEC) and other regulators have embraced its concepts, and regulatory enforcement has increased proportionally, both domestically and abroad.*
SEC enforcement actions
The SEC has engaged in enforcement actions against companies who have used and relied upon models, which were later discovered to have had errors, inadequate controls, and poor governance. Recent cases (summarized on the reverse) have resulted in sanctions and penalties.
- 100% of all cases financial penalties were levied
- 67% of the cases investors and clients were paid by the company
- 50% of the cases a monitor was appointed
What should companies be thinking about when allegations of model errors arise?
Circumstances surrounding alleged error
- From an independent perspective, is the allegation of an error true?
- How and when was the error first introduced into the business environment?
- How and when was the error discovered? Was it corrected in a timely manner?
- Does the model contain other errors?
- Does the company use other models which may contain the same or similar errors?
Materiality and harm
- Was the error material, and did it impact any business decisions or disclosures, or cause any harm to customers or shareholders?
Controls
- Why was the error not prevented or detected sooner?
- What steps has the company taken to enhance controls to prevent, detect, and correct future model errors?
- What should the company be doing to demonstrate reasonable controls over its models? Reasonable effectiveness of its models?
Awareness and disclosure
- How and when should the board be briefed?
- Should the company pre-emptively self-disclose to its regulators, auditors, and/or other stakeholders?
- How should the harms, if any, be redressed?
Recent case summaries: SEC enforcement
- A private investment firm and related entities were charged with securities fraud for concealing an error that caused substantial investor losses.
- $25 million in civil penalties paid by company
- $2.5 million in civil penalties paid by CEO or investment manager
- $216.8 million in payments to clients and investors
- √ Imposition of a monitor
- The SEC alleged that a registered investment adviser replaced live traders with a model-based semi-systematic trading system, without disclosing this to the investors in its flagship client hedge fund; the model contained ongoing model and operational errors which caused losses to investors in this fund; and although internal management was aware of these issues, timely and effective remediation steps were not taken.
- $37.3 million in civil penalties paid by company
- $107.6 million in payments to clients and investors
- $25.2 million in interest paid
- An analyst with no experience in portfolio management or financial modeling developed a quantitative model to manage investment strategies. Several errors were discovered that were not adequately corrected or disclosed.
- $36.3 million in civil penalties paid by company
- $53.3 million in payments to clients and investors
- $8 million in interest paid
- Legal proceedings arose after a company violated the Investment Company Act’s prohibition on cross trades between investment companies and first- or second degree affiliated persons. Its compliance systems were inadequate and failed to identify the disallowed cross trades.
- $1 million in civil penalties paid by company
- $7.4 million in payments to clients and investors
- √ Imposition of a monitor
- A company’s model for rating residential mortgage-backed securities lacked adequate controls and oversight, and it was unable to timely detect and prevent numerous model errors in a timely fashion.
- $16.25 million in civil penalties paid by company
- √ Imposition of a monitor
- An analyst at a data services company discovered that one of the models used to determine daily price valuations for fixed-income securities was, on occasion, erroneously selecting a single-point value as the daily price it disclosed to investors, instead of the weighted-average methodology disclosed in its 10-K. The SEC imposed a $5 million penalty and required the company to make overall improvements to its model quality control program.
- $5 million in civil penalties paid by company
Assessing potential model risks and errors
Regulators expect organizations to employ sound processes for model validation and model risk management, including reasonable governance and control mechanisms. CRA has deep experience independently investigating situations where models may not have functioned as intended or were used for purposes that differed from those for which the models were originally designed. We invite you to contact us or other members of our team to continue the conversation.
