Ethics, Regulation and Model Governance

Introduction

Predictive analytics has become central to insurance pricing, underwriting, claims management, fraud detection, reserving, customer service and capital management. By converting historical and behavioural data into predictions, insurers can improve risk classification, allocate resources and design products more efficiently. Yet predictive power does not by itself establish legitimacy. A model may be statistically accurate while violating privacy, producing unlawful discrimination, obscuring important decisions or weakening accountability.

Insurance is especially sensitive because model outputs can affect access to protection, premium affordability, claims payments and financial security. The ethical and regulatory question is therefore not simply whether a model predicts well, but whether it is appropriate to use, legally permissible, understandable, contestable and properly controlled throughout its life cycle.

This chapter presents a governance framework for responsible predictive analytics. It addresses privacy, consent, transparency, discrimination, proxy variables, explainability and accountability, together with documentation, validation, approval, audit, access control and model-risk management. Specific legal requirements differ across jurisdictions; therefore, the principles discussed here should be applied alongside applicable insurance, data-protection, equality, consumer-protection and financial-services laws.

Learning Objectives

By the end of this chapter, students should be able to:

1. Explain the ethical and regulatory risks associated with insurance analytics.
2. Distinguish privacy, consent, transparency, explainability and accountability.
3. Identify direct and indirect discrimination and detect harmful proxy variables.
4. Design a model-governance life cycle covering documentation, validation, approval, monitoring and audit.
5. Evaluate model risk using performance, fairness, privacy, operational and compliance perspectives.
6. Recommend controls for responsible deployment of predictive models.

1. Why Governance Is Strategic in Insurance

Model governance is the system through which an organisation directs, controls and reviews models. It includes policies, roles, standards, evidence requirements, approval gates, monitoring and remediation. It is not limited to technical model development. Governance begins when a business problem is defined and continues after a model is retired.

The strategic importance of governance arises from five characteristics of insurance models:

• Material impact: pricing and claims decisions can materially affect customers and financial results.
• Information asymmetry: customers usually cannot inspect the data or logic used by an insurer.
• Long-term contracts: errors may persist across renewals and affect reserving and capital decisions.
• Regulatory scrutiny: insurers are subject to conduct, prudential, data-protection and anti-discrimination obligations.
• Systemic dependence: multiple models may rely on the same data, vendors or assumptions, creating correlated weaknesses.

A useful governance principle is that responsibility follows the decision, not merely the algorithm. A data scientist, vendor or automated system cannot become a substitute for accountable managerial and professional judgment.

2. Ethical Foundations for Predictive Insurance

2.1 Beneficence and non-maleficence

Analytics should create legitimate benefits, such as faster claims settlement or more accurate risk assessment, while avoiding foreseeable harm. Harm may include unjustified premium increases, denial of coverage, intrusive surveillance, inaccurate fraud accusations or exclusion of vulnerable groups.

2.2 Fairness and equality

Fairness is not a single mathematical property. It may mean equal treatment, equal opportunity, similar error rates, proportionality, actuarial relevance or avoidance of unjustified disadvantage. These interpretations can conflict. For example, equal false-positive rates across groups may not be simultaneously achievable with equal predictive values when base rates differ.

Consequently, fairness must be defined in relation to the decision, legal rules, actuarial purpose and affected stakeholders. A fairness metric should inform judgment rather than replace it.

2.3 Autonomy and respect

Customers should not be treated merely as sources of data. Respect for autonomy requires appropriate information, meaningful choices where feasible, and the ability to question or challenge important decisions.

2.4 Justice and proportionality

The intrusion, restriction or disadvantage created by an analytic practice should be proportionate to its legitimate purpose. Collecting precise location data to improve fraud detection may be inappropriate if a less intrusive variable achieves a comparable result.

2.5 Accountability

Accountability means that a responsible person or body can explain who authorised a model, how it was used, what controls applied, what evidence supports it and how errors are corrected. Accountability is different from attributing blame after an incident; it is an ex ante design requirement.

3. Privacy, Data Protection and Consent

3.1 The data life cycle

Privacy governance should cover the complete data life cycle:

1. collection;
2. storage and security;
3. preparation and linkage;
4. modelling and sharing;
5. decision use;
6. retention and deletion.

A dataset can become sensitive through combination. Seemingly ordinary variables—postcode, occupation, age, vehicle type and transaction time—may jointly reveal health, wealth, ethnicity or location patterns.

3.2 Data minimisation and purpose limitation

Data minimisation means using no more personal data than is necessary for a specified, legitimate purpose. Purpose limitation means that data collected for one purpose should not automatically be repurposed for another incompatible purpose. A model-development team should document why each influential feature is necessary, how long it will be retained and who may access it.

3.3 Consent is not the only safeguard

Consent is permission given by an individual for specified processing. It should be informed, specific and freely given where the law requires those conditions. Consent may be unsuitable when there is a significant power imbalance, when refusal prevents access to an essential service, or when customers cannot reasonably understand the consequences.

Depending on jurisdiction, other lawful bases may apply, such as contractual necessity, legal obligation or legitimate interest. However, a lawful basis does not automatically make processing ethical. Necessity, proportionality, transparency and security remain relevant.

3.4 Sensitive and inferred data

Sensitive information may include health status, biometric identifiers, genetic information, racial or ethnic origin, religious belief, sexual orientation and political affiliation, depending on local law. Predictive systems may also infer sensitive characteristics from non-sensitive data. Governance must therefore assess not only what is collected but what can be inferred.

3.5 Privacy-enhancing controls

Useful controls include access restriction, encryption, pseudonymisation, aggregation, retention limits, secure development environments, privacy impact assessments and separation of identifying information from modelling data. Anonymisation should not be claimed merely because names have been removed; re-identification risk must be assessed in context.

4. Transparency and Explainability

4.1 Distinguishing the concepts

Transparency concerns disclosure about the existence, purpose, data sources, broad operation and consequences of a model. Explainability concerns why a particular output was produced or how the model behaves. Interpretability generally refers to the extent to which the model itself can be understood. Accountability concerns responsibility and remedy.

A technically explainable model can still be non-transparent if customers are not told that automated analytics are used. Conversely, a transparent notice may not explain why a particular premium increased.

4.2 Levels of explanation

A robust explanation may operate at three levels:

• System level: purpose, governance, data categories, limitations and responsible owner.
• Model level: relevant variables, training population, validation results, performance boundaries and known exclusions.
• Decision level: principal factors affecting an individual outcome, subject to security and legal constraints.

Explanations should be accurate, comprehensible and actionable. A statement such as “the algorithm determined your premium” is not an explanation. A better explanation identifies material factors, such as driving history, annual mileage and vehicle characteristics, while indicating how the customer may correct inaccurate information or request review.

4.3 Explainability methods and limitations

For a linear model, a coefficient indicates the expected change in the model's output associated with a one-unit change in a feature, holding other included features constant. This interpretation depends on the model specification and does not establish causation. For complex models, feature-importance methods, local surrogate explanations and counterfactual explanations may assist interpretation, but they can be unstable, approximate or misleading when features are correlated.

A counterfactual explanation asks what minimal change might have produced a different outcome. It should not suggest impossible or inappropriate changes, such as changing age or ethnicity. Explanations must therefore be reviewed for feasibility, fairness and consistency with the actual model.

5. Discrimination and Proxy Variables

5.1 Direct and indirect discrimination

Direct discrimination occurs when a protected characteristic is explicitly used to disadvantage a person, where such use is unlawful or unjustified. Indirect discrimination occurs when a neutral rule disproportionately disadvantages a protected group and cannot be justified as necessary and proportionate.

Insurance complicates this analysis because risk classification is the economic foundation of underwriting. A variable may be actuarially predictive yet legally restricted or ethically problematic. Actuarial correlation alone does not establish permissible use.

5.2 Proxy variables

A proxy variable is a feature that conveys information about a protected or sensitive characteristic through another attribute. Examples may include geographic area, language preference, purchasing patterns, occupation, device type or social-network structure. Removing a protected attribute does not remove discrimination if proxies remain.

Proxy analysis should combine statistical investigation with domain knowledge. A simple association measure may be expressed as:

where X is a candidate feature, Z is a protected or sensitive characteristic used for auditing, Cov is covariance, and σ denotes standard deviation. The expression is dimensionless and is applicable when both variables have finite, non-zero variance and the linear association is of interest. A high absolute value of ρ may indicate a proxy relationship, but a low value does not prove that no nonlinear or subgroup relationship exists.

5.3 Fairness metrics

For a binary decision, let TP, TN, FP and FN denote true positives, true negatives, false positives and false negatives. Common measures include:

TPR is the true-positive rate and FPR is the false-positive rate. These measures are meaningful only when the positive outcome and error costs are clearly defined. Group comparisons may reveal disparities, but they do not by themselves establish unlawful discrimination or identify the appropriate remedy.

Other measures include selection-rate parity, calibration and predictive-value comparisons. Because fairness criteria may be mathematically incompatible, organisations should document which criterion was selected, why it is relevant and what trade-offs were considered.

5.4 Mitigation strategies

Mitigation may occur before, during or after modelling:

• Pre-processing: improve representation, correct labels, remove unnecessary features or reweight observations.
• In-processing: impose fairness constraints or use a loss function that reflects unequal error costs.
• Post-processing: adjust thresholds or introduce human review for specified cases.
• Business-process controls: prohibit certain uses, limit model authority, provide appeals and monitor outcomes.

Removing a variable can reduce transparency if it hides a known source of disparity. Mitigation should therefore be documented and validated against both accuracy and fairness objectives.

6. Model Risk Management

Model risk is the possibility of adverse consequences because a model is incorrect, misused, misunderstood, poorly implemented or applied outside its intended conditions. It includes data risk, specification risk, estimation risk, implementation risk, operational risk, vendor risk and use risk.

A practical risk classification can consider:

• materiality of decisions affected;
• customer and regulatory impact;
• complexity and opacity;
• degree of automation;
• data sensitivity;
• uncertainty and performance instability;
• dependence on external suppliers.

Higher-risk models should face stronger validation, approval, monitoring and access controls. Governance should be risk-based rather than identical for every spreadsheet, scorecard and machine-learning system.

7. The Model-Governance Life Cycle

7.1 Use-case initiation

The business owner should define the decision, intended users, affected customers, expected benefits, prohibited uses and alternatives. A model should not be developed merely because data are available. A preliminary impact assessment should consider privacy, fairness, security, conduct and regulatory issues.

7.2 Data and feature approval

Data owners should document source, quality, lineage, permissions, population, missingness, retention and known limitations. Feature approval should record business rationale, sensitivity, proxy risk, stability and whether the feature is actionable or immutable.

7.3 Development standards

Development should use controlled code, reproducible datasets, versioning, separation of training and testing data, and safeguards against leakage. The model card or development report should state the objective, target definition, sampling method, assumptions, hyperparameters, performance measures and intended operating range.

7.4 Independent validation

Validation should be sufficiently independent from development. It should assess conceptual soundness, data quality, implementation correctness, performance, robustness, fairness, explainability, security and limitations. Validation is not simply a second calculation of accuracy; it asks whether the model is fit for its stated purpose.

A useful predictive metric for a continuous target is mean absolute error:

where n is the number of observations, yᵢ is the observed value and ŷᵢ is the prediction. MAE has the same units as the target and treats all absolute errors linearly. It is appropriate when a clear average absolute deviation is useful; it may not reflect the cost of especially large errors. Validation should use metrics suited to the decision, including calibration, discrimination, ranking, financial impact and subgroup performance where relevant.

7.5 Approval and deployment

Approval should be formally recorded by an authorised model-approval committee or accountable executive. Conditions may include restricted products, a pilot period, human review, thresholds, monitoring triggers and an expiry or review date. Production deployment should verify that the implemented model, data pipeline and decision rules match the approved version.

7.6 Monitoring and change control

Post-deployment monitoring should examine data drift, performance drift, calibration, fairness, complaints, overrides, adverse outcomes, security events and control breaches. A model may remain technically accurate while becoming inappropriate because customer behaviour, regulation, product design or economic conditions change.

Material changes require documented impact assessment and, where appropriate, revalidation and reapproval. Emergency changes should be logged and reviewed retrospectively.

7.7 Retirement

A model should be retired when it is obsolete, unsafe, uneconomic or no longer legally appropriate. Retirement includes disabling production access, preserving required records, communicating the change, transferring necessary knowledge and ensuring that downstream systems do not continue to rely on the retired output.

8. Documentation, Audit and Access Control

8.1 Minimum documentation

A complete model inventory should identify every material model, owner, purpose, status, version, data sources, users, vendors, risk rating and review date. A model file should normally contain:

1. business purpose and decision context;
2. legal and ethical assessment;
3. data lineage and feature definitions;
4. development methodology;
5. assumptions and limitations;
6. validation evidence;
7. fairness and privacy assessment;
8. approval conditions;
9. monitoring plan and thresholds;
10. change history and incidents;
11. explanation and customer-communication approach;
12. retirement plan.

Documentation is evidence of control, not administrative decoration. It should enable an informed reviewer to reproduce key conclusions and understand what the model must not do.

8.2 Auditability

Internal audit should evaluate whether governance operates effectively, not merely whether policies exist. Audit trails should record model versions, data snapshots where lawful, approvals, overrides, access events, incidents, customer challenges and remediation. Records must be retained in accordance with legal and business requirements while respecting data-minimisation principles.

8.3 Segregation of duties

The developer should not be the sole validator or approver of a high-impact model. Suitable separation may exist among the business owner, development team, independent validation, compliance, information security, internal audit and approval committee. Smaller organisations may use compensating controls, such as external validation or enhanced board oversight.

8.4 Access controls

Access should follow least privilege: each person receives only the permissions necessary for authorised work. Role-based access, multifactor authentication, privileged-access review, encryption, secrets management and logging are practical safeguards. Model artefacts and sensitive training data should be separated where feasible. Access should be removed promptly when roles change or employment ends.

9. Accountability and Human Oversight

Human oversight is meaningful only when the reviewer has authority, competence, time and access to relevant evidence. A nominal approval button does not create accountability. Human reviewers should understand model limitations, recognise potential bias, document reasons for overrides and avoid rubber-stamping automated recommendations.

Customers should have an appropriate route to correct data, request reconsideration and make complaints. An appeal process should specify eligibility, evidence, service standards, responsible staff and escalation. Human review should not be used selectively to legitimise an otherwise uncontrolled system; it must be monitored for consistency and bias.

Accountability should be allocated through a responsibility matrix. The business owner is accountable for legitimate use and outcomes; the development team is responsible for technical construction; validation provides independent challenge; compliance interprets obligations; information security controls access and threats; senior management accepts residual risk; and internal audit evaluates governance effectiveness.

10. Illustrative Case: Telematics-Based Motor Insurance

Background

An insurer proposes a telematics model that uses driving time, mileage, braking events, acceleration, road type and location patterns to price motor insurance. The stated objective is to reward safer driving and improve risk segmentation.

Problem

Pilot results show strong predictive performance, but premiums rise disproportionately for residents of certain urban areas. The team has removed ethnicity and income from the model, believing that discrimination has therefore been eliminated. Customers also report that they do not understand how their scores are calculated.

Analysis

The location variables may proxy for socioeconomic conditions or protected characteristics. Urban drivers may face different traffic density, road design and parking constraints that are not equivalent to careless driving. The model may also overrepresent customers who consent to telematics, creating selection bias. Continuous location tracking creates privacy and security risks, and a high frequency of harsh-braking events may reflect emergency avoidance rather than unsafe behaviour.

The insurer should compare performance and error rates across relevant groups, investigate proxy relationships, test alternative feature sets and assess whether the pricing effect is proportionate to the legitimate actuarial purpose. It should distinguish variables that measure controllable driving behaviour from those that merely encode neighbourhood circumstances.

Approach and solution

The governance committee requires the insurer to:

1. conduct a privacy and equality impact assessment;
2. explain data collection, retention, sharing and pricing effects in plain language;
3. obtain appropriate permission or establish another lawful basis;
4. limit location precision and retention to what is necessary;
5. test models with and without detailed location features;
6. validate subgroup calibration and error rates;
7. provide a human review and correction route;
8. prohibit use of the score for unrelated marketing or claims surveillance;
9. introduce monitoring thresholds for disparity, drift and complaints;
10. approve deployment only as a controlled pilot with a sunset review.

Outcome

The revised model uses broader road-context categories, reduces location precision, excludes features with weak actuarial justification and introduces customer explanations and appeals. Predictive performance decreases modestly, but the insurer obtains stronger evidence of proportionality, improves customer trust and reduces regulatory and reputational exposure.

Learning points

Removing protected attributes is not sufficient to prevent discrimination. Privacy, fairness and accuracy must be assessed together. A small reduction in predictive performance may be justified when it materially improves legitimacy, transparency and customer protection. Governance can therefore create strategic value rather than merely constrain innovation.

11. Contemporary Developments and Critical Issues

Generative AI, foundation models, synthetic data and automated machine-learning platforms increase both capability and governance complexity. Synthetic data may reduce exposure to real individuals but can reproduce or amplify the statistical properties and biases of the source data. Automated feature engineering can generate proxies that developers did not intentionally select. Vendor claims of confidentiality do not replace an insurer's responsibility to assess data use, model behaviour, security and subcontractors.

Regulatory approaches increasingly emphasise risk-based controls, documentation, human oversight, data governance, transparency and impact assessment. However, laws differ regarding automated decision-making, high-risk systems, sensitive data, pricing factors and individual rights. Insurers operating across jurisdictions should map the strictest applicable requirements to each use case and maintain jurisdiction-specific controls where necessary.

A continuing scholarly debate concerns whether fairness should be achieved through technical parity measures or through broader institutional reform. A model can satisfy a selected metric while the underlying product remains unaffordable or inaccessible. Responsible insurance analytics therefore requires attention to product design, distribution, claims practice and social consequences, not only model statistics.

12. Best-Practice Governance Checklist

Before deployment, an insurer should be able to answer “yes” to the following questions:

• Is the purpose legitimate, necessary and clearly defined?
• Are data sources lawful, relevant, accurate and proportionate?
• Have sensitive attributes and proxies been assessed?
• Are affected customers given meaningful information and remedies?
• Are performance, calibration, robustness and subgroup outcomes validated?
• Is the model independently challenged and formally approved?
• Are ownership, access, versioning and change controls documented?
• Are monitoring thresholds, escalation routes and shutdown criteria specified?
• Can the organisation reconstruct a material decision and explain it?
• Is there a tested process for complaints, correction and remediation?

These questions should be treated as minimum controls, not a substitute for professional judgment.

Challenges and Limitations

Responsible model governance faces practical difficulties. Protected-attribute data may be unavailable or legally restricted, making fairness measurement difficult. Small subgroups produce uncertain estimates. Fairness metrics can conflict, and remediation may reduce aggregate accuracy. Explanations may expose security-sensitive information or encourage gaming. Excessive documentation can become performative if decision-makers do not read it. Independent validation may be constrained by limited expertise, scarce resources or vendor opacity.

There is also a risk of automation bias: staff may trust a model because it appears objective. Conversely, excessive caution can prevent beneficial innovation. Effective governance therefore uses proportional controls, evidence-based challenge and continuous learning. It acknowledges uncertainty rather than presenting model outputs as facts.

Chapter Summary

Ethical and regulatory governance is an integral part of predictive analytics in insurance. Privacy requires lawful, proportionate and secure data practices across the full life cycle. Consent may support processing but does not alone establish ethical legitimacy. Transparency tells stakeholders what a system does, while explainability addresses how it reaches outputs; accountability ensures that responsible people can justify decisions and provide remedies.

Discrimination may be direct or indirect, and proxy variables can preserve bias even when protected attributes are excluded. Fairness metrics are useful diagnostic tools but involve trade-offs and must be interpreted in legal, actuarial and social context. Model-risk management should cover use-case definition, data approval, development, independent validation, formal approval, deployment, monitoring, change control and retirement.

Strong governance requires clear ownership, segregation of duties, documentation, audit trails, least-privilege access, meaningful human oversight and customer appeal mechanisms. The strategic objective is not to eliminate all uncertainty but to ensure that analytics are accurate enough, fair enough, secure enough, explainable enough and controlled enough for their intended use.

Key Terms

Privacy: Protection of individuals’ information and control over its appropriate use.

Consent: Informed permission for specified data processing.

Purpose limitation: Restriction of data use to specified and compatible purposes.

Data minimisation: Use of no more personal data than necessary.

Transparency: Disclosure about a system’s purpose, operation and consequences.

Explainability: Ability to communicate why a model or decision produced an outcome.

Interpretability: Extent to which a model’s structure or behaviour can be understood.

Accountability: Allocation of responsibility for decisions, controls and remedies.

Direct discrimination: Explicit disadvantage based on a protected characteristic.

Indirect discrimination: Disproportionate disadvantage caused by an apparently neutral practice.

Proxy variable: A feature that indirectly conveys information about a sensitive characteristic.

Fairness metric: A quantitative measure used to assess group disparities or equitable performance.

Model risk: Potential harm from incorrect, misused, misunderstood or poorly controlled models.

Model validation: Independent assessment of a model’s conceptual soundness, implementation and performance.

Model inventory: Controlled register of models, owners, uses, versions and risk classifications.

Data lineage: Record of data origin, transformation, movement and use.

Drift: Change in data, relationships or performance after deployment.

Least privilege: Provision of only the access necessary for authorised activity.

Human oversight: Competent and empowered review of model use and outcomes.

Model retirement: Controlled withdrawal of an obsolete or unacceptable model.

Review Questions

Short Answer Questions

1. Distinguish transparency from explainability.
2. Why can removing protected characteristics fail to eliminate discrimination?
3. What is the purpose of independent model validation?
4. Explain the principle of data minimisation.
5. Identify four elements that should appear in a model inventory.

Long Answer Questions

1. Discuss the ethical foundations of predictive insurance, including proportionality, justice and accountability.
2. Explain how privacy, consent, security and purpose limitation should be integrated into an insurance model life cycle.
3. Evaluate the advantages and limitations of fairness metrics in insurance underwriting or pricing.
4. Describe a complete model-governance life cycle from use-case initiation to model retirement.
5. Analyse the relationship between explainability, customer appeals and human oversight.

Analytical / Application Questions

1. An insurer removes postcode from a claims-fraud model, but device type and payment behaviour still produce different referral rates across demographic groups. Design an investigation for proxy discrimination and recommend possible controls.
2. A predictive pricing model has lower overall error but substantially higher false-positive rates for one customer group. Explain what further evidence is required before deployment and propose a decision framework.
3. Develop a governance plan for a vendor-supplied telematics model, covering privacy, validation, contractual controls, monitoring, access, audit and incident response.

Multiple Choice Questions with Answers

Question 1

Which statement best distinguishes transparency from explainability?

A. Transparency concerns system disclosure, while explainability concerns reasons for outputs

B. Transparency concerns encryption, while explainability concerns authentication

C. Transparency is only a technical property, while explainability is only a legal property

D. Transparency and explainability are identical concepts

Correct Answer: A. Transparency concerns system disclosure, while explainability concerns reasons for outputs

Question 2

Why can excluding ethnicity from an insurance model fail to prevent discrimination?

A. Ethnicity is always required for accurate prediction

B. Other variables may act as proxies for ethnicity or related social conditions

C. Models cannot operate without protected characteristics

D. Fairness is unrelated to model features

Correct Answer: B. Other variables may act as proxies for ethnicity or related social conditions

Question 3

Which principle requires an insurer to collect no more personal data than is necessary for a defined purpose?

A. Data minimisation

B. Model drift

C. Segregation of duties

D. Calibration

Correct Answer: A. Data minimisation

Question 4

In the formula TPR = TP ÷ (TP + FN), what does TPR represent?

A. The false-positive rate

B. The true-positive rate

C. The total premium ratio

D. The technical pricing reserve

Correct Answer: B. The true-positive rate

Question 5

Which activity is most characteristic of independent model validation?

A. Marketing the model to customers

B. Approving the developer’s annual leave

C. Assessing conceptual soundness, implementation and performance independently

D. Replacing all business judgment with automation

Correct Answer: C. Assessing conceptual soundness, implementation and performance independently

Question 6

What is the main purpose of least-privilege access?

A. To give every employee access to all model data

B. To provide only the permissions necessary for authorised work

C. To eliminate the need for audit trails

D. To prevent all model changes permanently

Correct Answer: B. To provide only the permissions necessary for authorised work

Question 7

A model’s accuracy remains stable, but the population and customer behaviour have changed substantially. Which governance concern is most relevant?

A. Data or concept drift

B. Encryption strength only

C. Retirement of all company records

D. Removal of all validation procedures

Correct Answer: A. Data or concept drift

Question 8

Which statement about consent is most accurate?

A. Consent automatically makes every use ethical and lawful

B. Consent is irrelevant to personal data

C. Consent may support processing, but proportionality, transparency and security remain relevant

D. Consent permits unlimited secondary use forever

Correct Answer: C. Consent may support processing, but proportionality, transparency and security remain relevant

Question 9

Who should normally not be the sole validator and approver of a high-impact model?

A. The model developer

B. The internal audit function

C. An independent reviewer

D. The risk committee

Correct Answer: A. The model developer

Question 10

Which is an example of a post-deployment model-governance control?

A. Monitoring performance, fairness, complaints and data drift

B. Deleting all documentation immediately after approval

C. Allowing uncontrolled feature changes

D. Disabling customer appeal mechanisms

Correct Answer: A. Monitoring performance, fairness, complaints and data drift