Modern Banking Risk Requires a New Model Beyond Likelihood and Severity

As federal banking agencies refresh model risk guidance and the FDIC flags funding, interest-rate and credit pressures, FFERM Technologies founder Dr. Jeffrey L. Edwards says static heat maps cannot show how risks interact, compound and blindside institutions.

The most dangerous banking risks do not happen every day. That is the flaw Dr. Jeffrey L. Edwards, founder and CEO of FFERM Technologies, says traditional bank risk models keep missing. In a standard heat map, the most urgent risk is often treated as the event that appears most probable and most damaging. But in real banking crises, the events that do the most damage, such as a bank run, liquidity shock, major model failure or a regulatory breakdown, are not constant occurrences.

“Risk leaders are often taught to look for high likelihood and high severity,” Edwards said. “But what risk happens all the time and is catastrophic? The calculation can be mathematically correct and still be logically wrong, because it calculates risks in isolation instead of asking which ones feed, trigger or depend on each other.”

Federal banking agencies recently issued revised model risk management guidance, while the Federal Deposit Insurance Corporation’s (FDIC) 2026 Risk Review highlighted funding, interest-rate and credit pressures facing banks. For Dr. Edwards, the timing points to a larger problem: banks have more models, reports and dashboards than ever, but many still lack a practical way to see how risk behaves across the enterprise.

A New Regulatory Moment

The warning comes as federal banking agencies sharpen their focus on model risk management. In April 2026, the Office of the Comptroller of the Currency (OCC), the Federal Reserve Board (FRB), and the Federal Deposit Insurance Corporation issued updated interagency guidance on model risk management.

For Dr. Edwards, that update reflects a broader shift. Banks are operating in a risk environment where models are more embedded in decision-making, threats move faster, and risk categories no longer remain neatly separated.

“Model risk is not just a technical issue anymore,” Dr. Edwards said. “It is part of the way banks make decisions, manage controls and prove governance. If the model is incomplete or misunderstood, the risk does not stay inside one box.”

Read More on Fintech : Global Fintech Interview with Baran Ozkan, co-founder & CEO of Flagright

Why Heat Maps Miss Chain Reactions

Traditional risk frameworks often ask two questions: how likely is the risk, and how severe would it be? FFERM proves this is no longer enough. In modern banking, a single weakness can move through the institution as a chain reaction.

A process failure, for example, may begin as operational risk. If that process affects interest-rate modeling or credit calculations, it can evolve into model or credit risk. If regulators identify the weakness, it can become regulatory risk. If customers or counterparties lose confidence, it can escalate into reputational damage. Viewed separately, each item may appear manageable. Viewed together, they may reveal a systemic problem.

The OCC’s Fall 2025 Semiannual Risk Perspective highlighted credit, market, operational and compliance risks in the federal banking system, while also noting increased threats from foreign state-sponsored actors and sophisticated cybercriminal groups, along with frauds and scams.

From Static Reporting to Risk Intelligence

Dr. Edwards says one of the most common mistakes in bank risk management is confusing more reporting with better intelligence. A report can summarize what has already been entered, reviewed, or measured, but it does not necessarily show how risk is changing, how one exposure is influencing another, or which root causes should be addressed first.

“Reports only give you what you give them,” Edwards said. “Intelligence provides information and a framework for decision-making. A report can be outdated within minutes. Risk intelligence must evolve as risk evolves.”

That distinction matters as banks respond to a complex operating environment. The FDIC’s Review also pointed to ongoing pressures tied to securities values, profitability, funding challenges, liquidity, deposit growth, wholesale funding and several lending categories.

For FFERM, those are not separate storylines. They are signals that banking risk must be understood as an interconnected system.

The Four-Factor Shift: Behavior, Not Just Scores

FFERM Technologies developed a patent-pending Four-Factor Enterprise Risk Management methodology designed to expand beyond traditional likelihood-and-severity scoring.

The model evaluates risk through four dimensions:

• Compounding: Whether a risk is systemic, growing or likely to amplify other risks.
• Severity: Potential damage if the risk materializes.
• Likelihood: Probability that the risk will occur.
• Predictability: Whether leaders have enough visibility to know if or when the risk is approaching.

“The Four-Factor model takes the conversation out of the math and puts it into behavior,” Dr. Edwards said. “If I have high compounding, I know the risk is systemic and growing. If I have high compounding and high severity, I know I have a severe risk that is systemic and growing. If predictability is low, I may not know when it is coming. That is the kind of conversation boards, CROs, CCOs and audit leaders should be having.”