Answers to the European Commission on the ... - Eiopa - Europa

11.58 There should be few descriptive rules or o<strong>the</strong>r restrictions on <strong>the</strong> form
of <strong>the</strong> IT approach. In particular, <strong>the</strong> trend of decentralizing <strong>the</strong> risk
management procedures should not be inhibited, provided that suitable
regard is paid <strong>to</strong> <strong>the</strong> global risk position. 'Data-warehousing', consisting
of <strong>the</strong> collection of data from each business unit in<strong>to</strong> one overarching
data warehouse for <strong>the</strong> entity, tends <strong>to</strong> be <strong>to</strong>o inflexible and can lead <strong>to</strong>
data consistency problems. While consistency is important, overcentralisation
should not be imposed by <strong>the</strong> supervisory authority.
11.59 Internal models are likely <strong>to</strong> involve complex IT solutions. The
documentation <strong>the</strong>reof should be suitable <strong>to</strong> support <strong>the</strong> validation
process of internal models; in particular intermediate results should be
checkable. Hence, <strong>the</strong> documentation of IT solutions should be proper
and transparent. Moreover, it would be useful if IT solutions contained
open standardized interfaces and standardized file formats (for e.g. for
risk driver and exposure data) <strong>to</strong> ensure fast and easy data
transmission <strong>to</strong> <strong>the</strong> supervision authority.
11.60 Making use of <strong>the</strong>se data transmissions, supervisors would have <strong>the</strong>
possibility <strong>to</strong> install processes for speedy review of models and changes
<strong>to</strong> models, and <strong>to</strong> ensure that <strong>the</strong> internal model continues <strong>to</strong> reflect
<strong>the</strong> circumstances of <strong>the</strong> undertaking.
11.61 Some of <strong>the</strong> software associated with <strong>the</strong> internal model may be
'external-provider' solutions or a mixture between 'external-provider'
and 'in-house' solutions. When it comes <strong>to</strong> outsourcing, <strong>the</strong> use of
external-provider software or data does not relieve <strong>the</strong> undertaking
from responsibility for any aspects of <strong>the</strong> use of <strong>the</strong> internal model
which would apply if <strong>the</strong> internal model were in its entirety an in-house
solution.
11.62 The parts of an internal model which are subject <strong>to</strong> outsourcing should
not be a 'black box' system, i.e. <strong>the</strong> supervisory authorities should be
supplied with a proper and transparent documentation of <strong>the</strong>se parts as
well.
CEIOPS' Advice
Supervisory aims with regard <strong>to</strong> internal models
11.63 CEIOPS supports <strong>the</strong> inclusion of a specific article in <strong>the</strong> Framework
Directive that sets out how <strong>the</strong> SCR might be calculated using an
internal model.
11.64 The Framework Directive should encourage undertakings <strong>to</strong> measure
risks with sufficient and proper accuracy, and <strong>to</strong> continually upgrade
<strong>the</strong>ir models as financial markets and technologies evolve. The
regula<strong>to</strong>ry framework for internal models should give supervisors <strong>the</strong>
flexibility <strong>to</strong> base <strong>the</strong>ir assessment of required capital on <strong>the</strong>
129