From the Joint Agency Policy Statement on Interest Rate Risk --
here Effective control of the interest rate risk management process includes independent review and, where appropriate, internal and external audit. The bank should conduct periodic reviews of its risk management process to ensure its integrity, accuracy and reasonableness. Items that should be reviewed and validated include:
• The adequacy of, and personnel's compliance with, the bank's internal control system.
• The appropriateness of the bank's risk measurement system given the nature, scope and complexity of its activities.
• The accuracy and completeness of the data inputs into the bank's risk measurement system.
• The reasonableness and validity of scenarios used in the risk measurement system.
• The validity of the risk measurement calculations. The validity of the calculations is often tested by comparing actual versus forecasted results.
The scope and formality of the review and validation will depend on the size and complexity of the bank. At large banks, internal and external auditors may have their own models against which the bank's model is tested. Banks with complex risk measurement systems should have their models or calculations validated by an independent source--either an internal risk control unit of the bank or by outside auditors or consultants.
The findings of this review should be reported to the board on an annual basis. The report should provide a brief summary of the bank's interest rate risk measurement techniques and management practices. It also should identify major critical assumptions used in the risk measurement process, discuss the process used to derive those assumptions and provide an assessment of the impact of those assumptions on the bank's measured exposure.