RP-004: Financial Model Audit Taxonomy
Executive Summary
Key Takeaways
- ✓ This taxonomy is derived from, and verified against, an operational rule engine's own classification of its 26 rules, not constructed independently for this paper.
- ✓ Structural is by far the largest category, reflecting that most audit-detectable failure modes concern model mechanics rather than governance, hygiene, or aggregation-specific logic.
- ✓ Category size and finding severity are independent — the two smallest categories (Aggregation Logic and Structural Hygiene) each have exactly one member rule, and one of those two carries critical severity.
- ✓ The taxonomy is stable but not fixed — it is defined to accommodate future rules within existing categories or, if genuinely warranted, a new category, without requiring existing rules to be recategorized.
Institutional publication. Not peer-reviewed.
Abstract¶
This paper presents a formal, six-category taxonomy of structural financial-model audit findings. The
taxonomy is not constructed for this paper — it is derived directly from, and verified against, the
category attribute each of 26 rules declares in a deployed, production rule engine (FMAE), making this a
description of an existing operational classification rather than a proposed one.
1. Method¶
Each of the 26 rules examined declares a category attribute as part of its own class definition in
source code. This taxonomy was derived by reading that attribute directly from every rule file, not by
independently classifying the rules' behavior from the outside. Where this paper's category counts are
cited elsewhere in FMAE's own documentation (the
Rule Taxonomy Technical Documentation
page), both were independently verified against the same source and found to agree.
2. The Six Categories¶
| Category | Member count | Defining concern |
|---|---|---|
| Structural | 18 | Whether a model calculates the way its own internal pattern implies it should |
| Assumptions Governance | 1 | Whether a business assumption is centralized in a controlled input layer |
| Integrity Controls | 2 | Whether a model's references and worksheet visibility are internally consistent |
| Structural Hygiene | 1 | Formatting-level structural risk affecting future extensibility |
| Aggregation Logic | 1 | Whether an aggregation formula's range correctly captures every intended line item |
| Model Governance | 3 | Whether a model's input layer is actively maintained |
3. Structural as the Dominant Category¶
Structural accounts for 18 of the 26 rules — a substantial majority. This reflects that the largest share of audit-detectable failure modes in a financial model concern its core mechanics: whether formulas are internally consistent, whether references resolve, whether calculations are free of circularity and propagated errors, and related concerns. The remaining five categories each address a narrower, more specific concern that does not fit within ordinary formula mechanics.
4. Category Size Is Independent of Severity¶
A central finding of this taxonomy, worth stating explicitly as a methodological point: category size carries no information about the severity of findings within it. The two narrowest categories — Aggregation Logic and Structural Hygiene — each contain exactly one rule. One of those single-member categories (Aggregation Logic, containing R023) is rated critical severity and is one of five rules capable of capping a model's overall grade under the SM-2.0 Scoring Methodology; the other (Structural Hygiene, containing R022) is rated high severity. A reader should not infer that a narrow category is a minor one.
5. Stability and Extensibility¶
This taxonomy is presented as the engine's current classification, not a permanently fixed scheme. New rules added to the engine in the future are expected to fit within one of the existing six categories in most cases; a genuinely novel failure mode not addressed by any existing category would warrant a new category rather than a forced classification, following the same principle that has kept the existing six categories conceptually distinct rather than overlapping.
Related Reading¶
- FMAE Rule Taxonomy — the Technical Documentation page this paper's taxonomy is derived from and cross-verified against.
- Rule Reference — individual pages for every rule in every category.
How OXXON tests thisRun a free structural check with FMAE
Frequently Asked Questions
Is this taxonomy specific to one audit engine, or a general classification of model risk types?
It is derived from, and describes, one specific deployed rule engine's own classification of its 26 rules. It is presented as a formal taxonomy because the underlying categories are general failure modes recognizable across financial models generally, not because it claims to be an industry-standard classification.
Why does the Structural category contain so many more rules than the others?
Because most audit-detectable structural risks concern how a model calculates — hardcoded values, broken references, circular calculations, formula inconsistency — which are all classified as Structural. The other five categories address narrower, more specific governance, integrity, hygiene, and aggregation-specific concerns.
Does a rule's taxonomy category indicate its severity?
No, and this is a specific point this paper makes explicitly. Category and severity are independent attributes; the two narrowest categories in this taxonomy each contain exactly one rule, and one of those single-member categories is rated critical severity.