Governance Briefing — PRA SS1/23 model risk management deadline

Executive briefing: The Prudential Regulation Authority’s Supervisory Statement SS1/23: Model risk management principles for banks takes effect on 17 May 2024 for firms in scope. Boards must approve a model risk appetite, maintain comprehensive inventories, assign accountability under the Senior Managers and Certification Regime, and ensure independent validation. The PRA expects firms to embed governance structures spanning AI, pricing, capital, and risk models.

Key governance signals

Board ownership. Boards are responsible for setting model risk appetite, ensuring reporting is decision-useful, and overseeing remediation of validation findings.
Lifecycle discipline. Firms need documented standards for development, implementation, usage, and decommissioning across first and second lines.
Independent validation. Validation must be sufficiently resourced, independent from model owners, and capable of challenging AI/ML techniques.

Action checklist

Finalize board-approved model risk policies, charters, and committee structures aligned to SS1/23 principles.
Consolidate model inventories with metadata on owners, materiality, usage, and validation status across banking and insurance portfolios.
Embed SR11-7, ECB TRIM, and SS1/23 expectations into AI and machine learning governance to avoid fragmented oversight.

Enablement moves

Implement dashboards tracking validation coverage, model performance metrics, and remediation timelines for board risk committees.
Upskill validation teams on machine learning testing techniques, scenario design, and explainability to challenge non-traditional models.
Run cross-functional walk-throughs so finance, risk, data science, and operations teams align on documentation and escalation workflows.

Sources

Zeph Tech supports PRA-regulated firms with model inventories, validation uplift roadmaps, and board reporting packs to evidence SS1/23 compliance.