Digital Brain
digital brain
digital brain

Guideline E-23: The Draft Enterprise-Wide Risk Management Guideline

January 2017 Financial Services Bulletin 3 minute read

The Office of the Superintendent of Financial Institutions (“OSFI”) released for comment its draft Enterprise-Wide Model Risk Management Guideline (“Guideline E-23”) on December 21, 2016.  The proposed guideline will apply to banks, foreign bank branches, bank holding companies, federally regulated trust and loan companies and cooperative retail associations.  OSFI asks that all interested parties submit written comments to OSFI no later than February 28, 2017.  The final version of the guideline is expected to come into force on November 1, 2017.

An Enterprise-Wide Model Risk Management Framework

Guideline E-23 seeks to establish a common standard for enterprise-wide model risk management to ensure that relevant institutions of all sizes, complexity and risk profile have a baseline understanding of the minimum level of expectations with respect to their use of models. Since models are approximations of reality, the use of models inherently carries with it a risk of error and consequent loss.

An enterprise-wide view of risk implies that modeling is used across an institution for a myriad of different applications under the rubric of risk management and stress testing, such as, for example, regulatory capital models, internal risk management models, valuation/pricing models and/or business decision-making models. Guideline E-23 is applicable to all models that have a material impact on the risk profile of an institution.

Guideline E-23 outlines the minimum prudent practices for internal model development, review, approval, use and modification which can be applied by institutions as they become increasingly reliant on models.  It is an institution’s responsibility to develop a consistent set of policies and procedures to identify, assess, manage and control the risks inherent to modeling based on the principles set out in the guideline.  It should be noted that Guideline E-23 considers specific challenges that the usage of models may pose for small and medium sized institutions.  Moreover, the guideline distinguishes between the institutions that are approved to use internal models for regulatory capital purposes (which are termed “internal models approved institutions” or “IMAIs”) and those that are not (termed “standardized Institutions” or “SIs”).  Guideline E-23 will not replace OSFI’s guidance with respect to models already set forth in other OSFI guidelines (see for example, the model validation requirement in Chapter 4 of the Capital Adequacy Requirements), but instead aims to supplement such pre-existing guidance.

Key Characteristics

An enterprise-wide model risk management framework should exhibit the following key characteristics, each of which is described in detail in Guideline E-23:

a) Appropriate governance systems over model usage;

b) Model materiality classifications and limitations, where appropriate, over the use of individual models;

c) Policies and processes around model selection and development;

d) Independent vetting and ongoing validation/review processes that continually assess the model’s performance and suitability;

e) Change control processes governing each stage of the model’s life cycle;

f) Internal audit functions to independently assess the model risk management governance and compliance framework; and

g) A model inventory that catalogues the type, classification and performance of all models in use, or that have been developed or recently decommissioned that could act as a benchmark or necessary substitute for a model in use.[1]

Other major jurisdictions have already codified standards and best practices for managing and controlling the use of models. Such codification is becoming increasingly important because of the evolution of banking markets and the amplified use of internal models by financial institutions.

If appropriate given the size, complexity and risk profile of an institution, it is expected that the governance and implementation of Guideline E-23 will be rolled into an institution’s overall governance framework established pursuant to OSFI’s Corporate Governance Guideline.

[1] Office of the Superintendent of Financial Institutions, “Enterprise-Wide Model Risk Management for Deposit-Taking Institutions”, December 2016, Online:

Insights (5 Posts)

Featured Insight

Part 1 | Capital Markets Podcast: The Clash Between Securities Law and Crypto

This podcast series dives into the future of crypto law.

Read More
Nov 24, 2022
Featured Insight

Update for Federal Employers: Changes to the Canada Labour Code and Regulations

Federal employers should prepare for the forthcoming approval and implementation of several regulations proposed under the Canada Labour Code.

Read More
Nov 24, 2022
Featured Insight

Bill 23 Update: Revisions Proposed to Bill 23 Following Lengthy Second Reading

Ontario's most talked about piece of legislation, Bill 23, received some revisions from the Standing Committee prior to Third Reading.

Read More
Nov 24, 2022
Featured Insight

McMillan’s Annual Privacy, Data Protection and Cybersecurity Client Seminar

Join McMillan's Privacy & Data Protection Group on Wednesday, December 7th for an overview of recent significant legal developments, tips on complying with new and forthcoming obligations under Quebec’s Bill 64, and discussions about hot topics in data management.

Wednesday, December 7, 2022
Featured Insight

OSC Signals Concerns about Gamification of Investing

The OSC cautions trading platforms about the use of gamification to incentivize investment after an experimental study shows these techniques are effective.

Read More
Nov 21, 2022