Article 368

1. Any internal model used for purposes of this Chapter shall be conceptually sound and implemented with integrity and, in particular, all of the following qualitative requirements shall be met:

(a) any internal model used to calculate capital requirements for position risk, foreign exchange risk or commodities risk shall be closely integrated into the daily risk-management process of the institution and serve as the basis for reporting risk exposures to senior management;

(b) the institution shall have a risk control unit that is independent from business trading units and reports directly to senior management. The unit shall be responsible for designing and implementing any internal model used for purposes of this Chapter. The unit shall conduct the initial and on-going validation of any internal model used for purposes of this Chapter, being responsible for the overall risk management system. The unit shall produce and analyse daily reports on the output of any internal model used for calculating capital requirements for position risk, foreign exchange risk and commodities risk, and on the appropriate measures to be taken in terms of trading limits;

(c) the institution's management body and senior management shall be actively involved in the risk-control process and the daily reports produced by the risk-control unit are reviewed by a level of management with sufficient authority to enforce both reductions of positions taken by individual traders as well as in the institution's overall risk exposure;

(d) the institution shall have sufficient numbers of staff skilled in the use of sophisticated internal models, and including those used for purposes of this Chapter, in the trading, risk-control, audit and back-office areas;

(e) the institution shall have established procedures for monitoring and ensuring compliance with a documented set of internal policies and controls concerning the overall operation of its internal models, and including those used for purposes of this Chapter;

(f) any internal model used for purposes of this Chapter shall have a proven track record of reasonable accuracy in measuring risks;

(g) the institution shall frequently conduct a rigorous programme of stress testing, including reverse stress tests, which encompasses any internal model used for purposes of this Chapter and the results of these stress tests shall be reviewed by senior management and reflected in the policies and limits it sets. This process shall particularly address illiquidity of markets in stressed market conditions, concentration risk, one way markets, event and jump-to-default risks, non-linearity of products, deep out-of-the-money positions, positions subject to the gapping of prices and other risks that may not be captured appropriately in the internal models. The shocks applied shall reflect the nature of the portfolios and the time it could take to hedge out or manage risks under severe market conditions;

(h) the institution shall conduct, as part of its regular internal auditing process, an independent review of its internal models, and including those used for purposes of this Chapter.

2. The review referred to in point (h) of paragraph 1 shall include both the activities of the business trading units and of the independent risk-control unit. At least once a year, the institution shall conduct a review of its overall risk-management process. The review shall consider the following:

(a) the adequacy of the documentation of the risk-management system and process and the organisation of the risk-control unit;

(b) the integration of risk measures into daily risk management and the integrity of the management information system;

(c) the process the institution employs for approving risk-pricing models and valuation systems that are used by front and back-office personnel;

(d) the scope of risks captured by the risk-measurement model and the validation of any significant changes in the risk-measurement process;

(e) the accuracy and completeness of position data, the accuracy and appropriateness of volatility and correlation assumptions, and the accuracy of valuation and risk sensitivity calculations;

(f) the verification process the institution employs to evaluate the consistency, timeliness and reliability of data sources used to run internal models, including the independence of such data sources;

(g) the verification process the institution uses to evaluate back-testing that is conducted to assess the models' accuracy.

3. As techniques and best practices evolve, institutions shall apply those new techniques and practices in any internal model used for purposes of this Chapter.