Risk Steering & Model Validation

Risk steering under CRR/CRD refers to the entire process by which a bank identifies, limits and actively manages its risks. This includes deriving risk limits from risk-bearing capacity, monitoring those limits in day-to-day business, and escalating when limits are breached.

Core elements of risk steering:

Without functioning risk steering, banks face capital add-ons in the SREP process, BaFin special audits and ultimately restrictions on business activities.

The new MaRisk module AT 4.3.5 on the use of models requires all institutions to establish systematic model risk management. The requirements include:

A particular challenge: Models based on machine learning are also subject to these requirements, which brings additional explainability demands.

An effective limit system translates risk-bearing capacity into operational control metrics. The process follows four steps:

1. Define risk appetite: Determine maximum risk tolerance at the overall bank level, derived from capital planning and business strategy.

2. Limit allocation: Distribute the total risk budget across risk categories, business lines and individual limits — consistently across all management levels.

3. Monitoring and escalation: Establish ongoing limit monitoring with defined traffic light levels (green/amber/red) and binding escalation processes when limits are approached or breached.

4. Feedback loop: Regularly review limit utilization and adjust allocations to changing market conditions and business strategies.

Consistency between risk-bearing capacity, risk appetite and the limit system is critical — gaps regularly lead to SREP findings.

Backtesting compares a risk model's predictions against actually realized losses and is the central quantitative tool of model validation.

Application areas:

Regulatory requirements for backtesting:

Backtesting alone is not sufficient: it must be supplemented by sensitivity analyses, benchmarking and qualitative assessment.

More precise risk steering directly impacts capital efficiency because less unused capital buffer needs to be held:

In practice, institutions with optimized risk steering achieve capital ratio improvements of 50 to 200 basis points — without needing to raise additional capital.

Risk controlling and risk steering are two closely linked but distinct functions in a bank's risk management:

Risk controlling encompasses:

Risk steering encompasses:

MaRisk requires organizational separation of both functions from the risk-taking business. In practice, however, both areas work closely together to ensure an end-to-end risk steering chain from risk appetite down to individual positions.

ADVISORI supports banks and financial services firms across all aspects of risk steering and model validation — from strategic design to operational implementation:

Our consultants have years of experience in banking regulation and have successfully delivered risk steering and validation projects at institutions of all sizes.