PortfolioCheck · Validation Model validation & governance Knowledge Centre →

Model validation & governance

The evidence a model-validation team, the Bank of Ghana, the IFC and the World Bank asked for: a documented version and dataset registry, a hindcast against a real Ghanaian flood event, and a parameter sensitivity analysis. This is screening-grade validation — it demonstrates the hazard layer points at the right places and that no single financial assumption dominates; it is not a catastrophe-model back-test.

1 · Accra flood — in-sample design-coverage check (3 June 2015 Odaw/Korle disaster)

Read this honestly. This is an in-sample check: the flood layer's basins were defined using this same June-2015 event, so a high hit/spare rate confirms the model captures its design intent — it is not an out-of-sample skill score, and the raw counts below (12/12 and 6/6) are on a small hand-picked set. Genuine out-of-sample validation against an independent event (e.g. Kumasi 2021, Accra 2023) with a multi-threshold ROC, plus an independent third-party model review, is the step before regulatory reliance. Note this hindcast runs on the offline SEED geographic model — the coarse triage layer, not the LIVE FloodGuard / Sentinel-1 screen the tool uses by default. The satellite-observed flood check (section 1b) is the stronger, out-of-sample signal.

Does the flood layer flag the localities the documented June-2015 flood inundated, and spare the higher-ground areas it did not? A flood score ≥ 0.50 counts as "High+ flagged".

12/12Flooded localities flagged (in-sample coverage, not a skill score)
6/6Higher-ground controls spared (in-sample)
18Localities in the check (small sample)

Documented flooded — should flag

LocalityFlood scoreResult
Kwame Nkrumah Circle0.83✓ flagged
Odawna0.91✓ flagged
Alajo0.67✓ flagged
Avenor0.76✓ flagged
Agbogbloshie0.82✓ flagged
Old Fadama0.86✓ flagged
Kaneshie0.71✓ flagged
Adabraka0.87✓ flagged
Nima0.75✓ flagged
Mamobi0.73✓ flagged
Korle Gonno0.68✓ flagged
Kasoa / Weija lowland0.78✓ flagged

Higher-ground control — should spare

LocalityFlood scoreResult
East Legon0.05✓ spared
Cantonments0.41✓ spared
Airport Residential0.41✓ spared
Adenta0.05✓ spared
Legon (University)0.05✓ spared
Oyarifa0.05✓ spared
Sources: the 3 June 2015 Accra flood-and-fire (~269 mm in 3 days; the Kwame Nkrumah Circle GOIL explosion; AMA demolitions along the Odaw and at Old Fadama/Agbogbloshie). At screening resolution the flood layer reproduces the event's geography; calibration to a bank's recorded loss amounts is the next step.

1b · Observed vs modelled flood — the satellite check (Sentinel-1)

Beyond modelled susceptibility, a live screen queries Sentinel-1 C-band radar (Copernicus, which images through cloud) using UN-SPIDER change detection. Where the satellite actually recorded standing water on a parcel, the tool floors flood at High and flags "Sentinel-1 OBSERVED FLOOD on <date>" — measured reality, distinct from the odds, with the observation date. This is an out-of-sample, observed signal (the complement to the in-sample hindcast above): it does not depend on the seed model at all.

Verified end-to-end against the October 2023 Lower Volta / Akosombo dam-spill flood — the satellite footprint (≈16,000 ha) flags the inundated parcels, and a probe there returns the observed flood on 2023-10-22. Strongest for open-water / floodplain / riverine exposure; by radar physics it does not capture brief urban flash-flooding under rooftops, so an empty result in a dense city is a sensor limitation, not an all-clear. Live now for Greater Accra and the Lower Volta; nationwide backfill is in quality-controlled validation.

2 · Parameter sensitivity — which assumption matters?

Each finance constant varied ±20%; the table shows the % change in the demo book's total climate-driven Expected Credit Loss (ECL) uplift (base GHS 462,495), ranked by span. The base book is the synthetic 200-asset seed demo. The dominant lever is the forced-sale recovery — a well-understood collateral parameter — and no single knob produces a runaway result.

Constant−20%+20%Span (impact)
Forced-sale recovery+54.9%-61.5% 116.4
Through-the-cycle base PD-20.0%+20.0% 40.0
AAL multiplier (global loss scale)-11.7%+13.1% 24.8
Capitalisation rate+14.1%-8.4% 22.5
Market repricing share of AAL-10.0%+11.1% 21.1
AAL convexity exponent+10.0%-7.6% 17.6
Downturn LGD floor+3.4%-3.4% 6.8
Uninsured share of damage-2.0%+2.0% 4.0
Acronyms: AAL = Average Annual Loss (expected yearly physical damage). ECL = Expected Credit Loss (PD × LGD × EAD). PD = probability of default · LGD = loss given default · EAD = exposure at default. Full definitions in the Knowledge Centre glossary.

3 · Return-period portfolio loss — the acute tail

Average annual loss understates a correlated catastrophe. Each hazard-prone region is modelled as an independent annual event (it fires with a probability rising with its acute-hazard severity and inflicts the simultaneous climate-LGD-weighted loss on its High+ assets); the portfolio loss distribution is the exact convolution of those events — deterministic, no Monte Carlo. Demo book: expected acute annual GHS 2.33M, worst single region Greater Accra (GHS 11.33M).

Return periodAnnual exceedancePortfolio loss
1-in-520.0% GHS 2.05M
1-in-1010.0% GHS 11.33M
1-in-254.0% GHS 12.55M
1-in-502.0% GHS 12.87M
1-in-1001.0% GHS 13.33M
1-in-2000.5% GHS 13.65M
An indicative screening tail, not a full catastrophe model — it does not resolve event footprints or sub-regional correlation, and the regional event probabilities are stated screening assumptions. It gives a risk committee the 1-in-50 / 1-in-100 view a supervisor's stress test and a reinsurer both expect.

4 · Model governance

Version 2.8.2 (2026-08-11) · Owner / developer: Dr. Minka Aduse-Poku (PortfolioCheck methodology owner and developer) · the active parameter set is stamped on every report and return, each return carries a SHA-256 submission fingerprint, and the SEED engine is deterministic and stdlib-only, so any seed result re-runs bit-for-bit. A LIVE screen additionally records the source, resolution and observation date of each engine response (FloodGuard, SafeGround, Sentinel-1), so a live result is reconstructable from its logged inputs.

Independent validation (three lines of defence). Independent third-party model validation: NOT YET COMMISSIONED — recommended (and required for regulatory reliance) before any bank files on this tool. Development and validation must be segregated before a bank relies on the tool for a regulatory filing — commissioning that review is a stated pre-go-live step, not an afterthought.

Hazard & data sources (with vintage)

LayerSourceVintage
Flood / surface waterFloodGuard susceptibility grid · MERIT Hydro · JRC Global Surface Water · SafeGround constraints · Sentinel-1 observed-event extents2021–2026
Coastal referenceOpenStreetMap coastline snapshot · ESA WorldCover 2021 land/water QA · Copernicus DEM elevation2021 / snapshot 2026-07-27
Coastal changeDated shoreline observations where available · Ghana sector literature registry · Ghana Hydrological Authority project reports2008–2025 / registry 2026-07-27
Coastal sea levelIPCC AR6 scenario increments · PSMSL Takoradi station 331 retained with quality warning and excluded from trend fittingAR6 / PSMSL 1929–2012
HeatERA5 hot-season apparent maximum and durable seasonal change · latitude + urban-heat-island + highland cooling in SEED modeERA5 through 2024
RiparianSafeGround mapped watercourse proximity · continuous major-river polyline network (Volta system, Pra, Ankobra, Tano, Densu…) with point-to-segment distance in SEED moderuntime / SEED
Land / protectedSafeGround protected-area, contamination and galamsey checks · Ramsar/protected anchors in SEED moderuntime / SEED
Drought / water stressNASA POWER rainfall climatology · FloodGuard rainfall deficit · Sentinel NDVI/VCI crop stress · aridity geography (savanna north + SE coastal dry belt) in SEED moderuntime through 2026
ScenariosIPCC AR6 SSP + NGFS (mapped) · World Bank Climate Knowledge PortalAR6 / 2024
Damage basisJRC Africa flood depth-damage curve (Huizinga et al. 2017) · First Street / UNDRR AAL tiers2017 / 2025
Agricultural governanceCanonical source-to-variable, quality, minimum-input and validation register in core/agri_governance.py2026-07-31
Agricultural calibration candidatesGhana MoFA SRID yields/production · FAO WaPOR v3 · CHIRPS v3 · ISRIC SoilGrids 2.0 · FAO AquaCropNot yet used in scoring; registered 2026-07-31
Bank loss-data schemaPortfolioCheck LOSS-1.0: event, exposure, physical/production loss, insurance, credit outcome and evidence lineage fields2026-07-31

Changelog

VersionDateChange
2.8.22026-08-11Accessibility self-audit pass (toward WCAG 2.2 AA). A visible keyboard-focus indicator on every focusable element and a prefers-reduced-motion guard now ship globally (via the theme block, and added to the pages that render their own CSS); a lang attribute on every page; an accessible name on the icon-only close control; and grey body/footer text darkened so it meets the 4.5:1 contrast minimum. Risk was already conveyed by text as well as colour, the map has a sortable-table equivalent, and forms are labelled — this pass closes the focus-visibility, contrast, lang and reduced-motion gaps. A formal independent audit remains recommended before a production go-live.
2.8.12026-08-11Production hardening for a regulated deployment: a tamper-evident AUDIT TRAIL. A new append-only audit_log records every security-relevant action — logins and failed logins, filed BoG returns (with fingerprint), adaptation submissions, supervisory verdicts, issued directives and account changes — with who, when, target and source IP. A BoG administrator views and filters it at /bog/audit. Confirmed already-present controls: DB-backed revocable sessions, PBKDF2 password hashing, a strict security-header set, and an Origin/Referer CSRF check with SameSite=Lax cookies on state-changing requests. +1 test (171).
2.8.02026-08-11Methodology depth pass (the review's non-loss-data calibration items). SEED riparian now uses a CONTINUOUS major-river polyline network (Volta system incl. White/Black Volta and Oti, Pra, Ofin/Birim, Ankobra, Tano, Densu, northern tributaries) with point-to-segment distance, so riverfront collateral between the old ~12 anchor points is no longer scored Low (the Odaw is excluded as an engineered storm drain, not a natural river). Heat and drought are decorrelated: heat gains highland cooling (a plateau is cooler than its latitude implies) and drought is driven by aridity geography — high in the savanna north AND the south-eastern coastal dry belt (Accra–Ada–Keta / Dahomey Gap), low in the wet south-west — rather than both being pure latitude. Documented coastal-erosion hotspots (Keta, Ada, Cape Coast, Sekondi-Takoradi) now escalate above Moderate in SEED mode and are counted in the money view; distance-only coastal proximity stays capped. +6 tests (170).
2.7.02026-08-07Methodology / GIS / correctness review — fixes from a four-lens adversarial audit before any bank relies on a number. CRITICAL: (1) LTV unit trap — an LTV keyed as a fraction (0.8) rather than percent (80) silently made a loan look 100x over-collateralised and hid all risk; LTV is now normalised (fraction->percent) and range-checked at ingest, the origination handlers and the finance engine. (2) Dashboard/report now agree — the client recompute dropped recorded incidents and the per-asset materiality weighting, mis-banding a flooded asset Moderate while the return said High; hz now ships raw with incident/profile applied client-side in the SAME order as the server, plus the server-authoritative band/score. (3) The Sentinel-1 observed-flood overlay is applied once, recency-gated (a stale historical extent is no longer replayed as a current observation) and banded consistently. HIGH: confidence now derives from the geolocation method + whether the screen was live (not from counting a float's decimal places), so a seed-only screen is never stamped HIGH; a single near-certain/observed peril can now reach Critical (a demonstrably-flooding property no longer bands like an ordinary house); the gazetteer matches whole words with a region cross-check (no more 400 km substring mis-geocode); the scenario 'today'/forward views and the portfolio projection reuse the exact effective findings, weighting and agri routing the asset was scored with. Also: no valuation is emitted for an out-of-Ghana/likely-swapped coordinate; PD capped at 100% and bank calibration params clamped to sane ranges; agricultural AAL expressed against production value (not land value); SafeGround fails closed to localhost; bare-list parcel rings sniff lat/lon orientation; one harmonised Ghana bounding box; the acute-tail convolution logs any event-regions excluded beyond its bound. +11 tests (167).
2.6.02026-08-06Per-asset risk weighting (materiality profiles). The six-hazard weighting now adapts to an asset's dominant physical setting so its most eminent threat leads the composite: tag an asset coastal / floodplain / farmland / urban (Building.risk_profile, a 'risk_profile' CSV column, or the probe's Risk-weighting selector) and the weights shift accordingly. A coastal or floodplain designation is treated as the bank's professional judgment that the lead peril is materially present, and floors that hazard at High — transparently labelled on the finding, only ever raising a score, never lowering a higher measured/observed one, and overridable by re-tagging. Untagged books score exactly as before; farmland keeps its drought-led profile. The probe suggests the fitting profile from the asset's own setting and shows which weighting was applied. Every profile vector is recalibratable per bank.
2.5.02026-08-06Sentinel-1 OBSERVED-flood scrutiny on the live screen. The probe/live screen now queries FloodGuard's Sentinel-1 SAR change-detection endpoint (C-band VH, UN-SPIDER) and, where the satellite actually saw water on the parcel, floors flood at High+ and surfaces it as measured reality distinct from modelled susceptibility — a red 'Sentinel-1 OBSERVED FLOOD on <date>' flag (bolder when it is a NEW flood the model rated lower), a green 'no observed flood' where clear, or an honest 'outside Sentinel-1 coverage (Greater Accra)' note elsewhere. So a bank can see whether the collateral it is lending against was recently underwater, not just its modelled odds. Nationwide coverage is the FloodGuard AOI-expansion build; Greater Accra is live now.
2.4.22026-08-06Location-probe search box gains type-ahead suggestions (dropdown as you type): a GhanaPostGPS code, instant built-in Ghana localities, then OpenStreetMap for broader coverage (no Google, no API key, no per-use cost — addresses go to OSM, not Google, consistent with the data-protection posture). Pick a suggestion to zoom the map and drop the pin; still confirm the exact building by clicking. New /api/geocode/suggest.
2.4.12026-08-06Origination probe defaults to LIVE (FloodGuard + SafeGround) — the seed model is a coarse portfolio-triage proxy and must never drive a single loan decision (it can read a riverbed as low flood). Live is now the default for the probe with its own generous rate budget (single-point screens are light); when live is momentarily unavailable the result is stamped a coarse estimate NOT VALID for underwriting, so a seed answer can never masquerade as the real assessment. A live screen shows FloodGuard rating the same Weija-reservoir point Critical where seed said Low.
2.4.02026-08-06Map-first location probe for loan officers. Type a place, address or GhanaPostGPS -> the satellite map zooms to it (via a new /api/geocode) -> click the exact building to drop the pin (precise regardless of geocoder coverage) or drag to fine-tune -> screen. The map is now full-width and prominent, the address hint and region dominate over a coarse region centroid, and client-side timeouts keep search and screening from ever hanging. GhanaPostGPS resolves the pin precisely where the resolution service is enabled. Same insight output (decision, hazard breakdown, today->2050, lender & insurer lenses, adaptation levers) and the Lender/Insurer view toggle.
2.3.02026-08-06Best-in-class single-location risk probe for loan officers and insurers. Probe one property (GhanaPostGPS, address or coordinates) and get, beyond the underwriting decision: a per-hazard plain-language breakdown (worst-first), a today->2050 forward view under a middle scenario, an insurer/broker lens (perils + insurability signal + cover-covenant note), and the adaptation levers that would most reduce THIS asset with their modelled band effect. A Lender/Insurer view toggle re-frames the same screen for either user. Mirrors First Street (per-peril property scores + forward view), Climate X / Jupiter asset-level scoring, and Cape Analytics / ZestyAI property underwriting. Served at /originate and via the /api/screen JSON (new 'insight' block) for embedding in an origination system.
2.2.02026-08-05Real bank->BoG return-submission pipeline. An institution FILES its current physical-risk return from its portfolio ('Submit to BoG'); the tool snapshots the Para-48 figures + a SHA-256 fingerprint into a persistent submission and returns a filing receipt. A Bank-of-Ghana account sees a live 'Received submissions' inbox (/bog/submissions) — every filed return with its figures, downloadable CSV and links to that institution's adaptation cases — proving the end-to-end pipeline with logged-in accounts rather than synthetic demo banks. A 'manage.py gen-book' command generates a synthetic book and files it in one step so the pipeline can be exercised without real customer data. (A filed submission is exactly the payload a future federated ORASS/API channel would carry between separately hosted institutions.)
2.1.52026-08-05In-app Bank-of-Ghana account administration: a BoG 'admin' tier manages its own department from /bog/users — add colleagues, set each as approver or read-only analyst, promote/demote and reset passwords, without server access. Scoped strictly to Bank-of-Ghana accounts, gated to admins (approvers and analysts get 403), with a self-role-change guard to prevent lock-out. New accounts default to least-privilege (analyst). Admin tooling also gains 'manage.py role <email> <role>' to change a tier without recreating the account.
2.1.42026-08-05Dedicated Bank-of-Ghana supervisory workspace and a proper regulator role model. A supervisor account now lands on an intuitive /bog home — live 'awaiting review' count, one-click into the adaptation-evidence queue, the system-wide console and the Directive mapping. Two named tiers: 'regulator' (approver — issues verdicts) and 'analyst' (read-only oversight — can inspect every submission and its evidence but cannot accept/reject; the decision endpoint enforces this server-side). Departments provision one named account per person for attributable verdicts; login routes regulators to the workspace and banks to their portfolios.
2.1.32026-08-05Persistent adaptation-evidence CASES for the authenticated book (ported and reconciled from a parallel Codex build): a logged-in institution opens a case per asset, attaches evidence (PDF/PNG/JPG/DOCX) and submits it; a Bank-of-Ghana supervisor account reviews the queue and issues an attributable verdict — accept, reject or request-more-information. Only an accepted verdict flips the asset's verified flag and re-scores it, recording baseline→improved. Adds a one-click BoG submission package (ZIP: physical-risk return + adaptation-case manifest + evidence files + fingerprinted receipt). This is the production acceptance path for the authenticated /p/{id} book, complementing the ephemeral demo-session review flow; class-filtered measures and nosniff evidence serving carried through.
2.1.22026-08-03Adaptation-communication and report-delivery hardening (six-issue audit): a bank's evidence-accepted credit can no longer be silently voided by an unrelated insurance/construction re-save; the supervisory evidence review rejects stale/replayed decisions and pins the scored measures to exactly the accepted set; the top-down re-run now measures the 'unverified adaptation pipeline' (filed vs claimed) instead of an always-zero gap; cross-class adaptation measures earn no credit; uploaded evidence is served with a server-determined content-type + nosniff (no stored-XSS); and each supervisor drill-down shows an explicit report-delivery panel with the Directive return section and SHA-256 submission fingerprint.
2.1.12026-07-31Supervisory landing-state hardening: no institution-level asset map or property details at sector level; the selector shows all 23 licensed banks, identifies received versus missing returns, and opens a scoped institution view only for a received return.
2.1.02026-07-31Reviewer-facing data and engine lineage: hazard-by-hazard source, endpoint, native/effective resolution, update rule, score transformation, uncertainty and financial-use gate; explicit disclosure that the 200-asset workbook demo runs in SEED mode.
2.0.02026-07-31Supervisory adaptation evidence gate: institutions may declare measures and upload supporting evidence, but only a BoG acceptance activates hazard, loss or regulatory-score credit; evidence is hashed and decisions retain an audit history.
1.9.02026-07-31Institutional loss register: complete supporting-sheet ingestion, cross-sheet and portfolio asset matching, institution-isolated persistent drafts, auditable events, maker/reviewer segregation, approval and calibration-development gates, data-quality dashboard, and explicit observed/verified/insurance/modelled separation in the saved asset view.
1.8.02026-07-31Loss Data Onboarding Centre: controlled multi-table XLSX template, flexible bank-header mapping, row-level validation, evidence grades, agricultural completeness tests, readiness stages, duplicate controls, short-lived upload sessions and separate accepted/correction exports. Observed, verified, modelled and unverified evidence remain explicitly separated.
1.7.02026-07-31Agricultural model-governance hardening: canonical source-to-variable register, data-quality hierarchy, minimum production-data schema, output-by-output validation status, calibration and independent-validation gate; explicit uncalibrated sensitivity labels in dashboard and asset drill-down; living methodology and downloadable source now carry the agricultural annex automatically.
1.6.02026-07-31Mixed-collateral dashboard: separate Combined, Buildings and Agriculture & land views; agricultural parcel polygons; farm-specific hazard weights, production-loss AAL, land-resilience repricing and climate-smart adaptation measures carried consistently through Python and browser calculations; dedicated 200-asset Ecobank synthetic workbook with 155 buildings and 45 agricultural parcels.
1.5.02026-07-27Independent-review methodology hardening: comprehensive living methodology thesis and downloadable source; explicit abbreviation, formula, evidence-grade, uncertainty, calibration and audit-status sections; expanded coastal data lineage; low-elevation DEM excluded from coastal loss; unsupported building AAL contributions removed for heat, riparian, land and drought, with riparian loss represented through flood to avoid double counting.
1.4.32026-07-24Stakeholder sign-off hardening (bank CRO, IT-security/DPO, consumer-protection, independent quant — all READY-WITH-CONDITIONS): disparate-impact/fairness monitor (per-locality High+ & repricing, outlier flag); anti-redlining banner surfaced in origination UI; price-exclusion + refer-resolution gap rows; CSV formula-injection guard on all exports; external climate/GhanaPostGPS connectors default OFF (air-gapped by default); supervisor write-endpoints rate-limited; submission fingerprint broadened to scenario/live-mode/all risk-modifier inputs; AAL per-term clamp; projected-finding band re-derived; dead repricing_fraction() removed; construction-factor source cited.
1.4.22026-07-24Four-hat BoG/sustainability review hardening: honest relabel of the in-sample flood check (was headline 100%/100%); illustrative supervisor-set risk thresholds (not Directive ceilings); advisory reframed as a synthetic DRAFT template (not a BoG-issued letter); Para 48 PARTIAL status on half-met items; fixed 43(d)(iv) citation + added 43(d)(v)/SBP; short/medium/long-term horizon labels; top-down re-run now keeps observed incidents; PCAF derived from geolocation precision; SHA-256 return fingerprint; adaptation-first origination; independent-validation governance note; GSBP 7-principle + SBFN + nature/inclusion honesty.
1.4.12026-07-22Living clause-by-clause Directive alignment (/directive) as the single source of truth; corrected the semi-annual return citation to Para 48 (Para 46 is the forthcoming Standardized Disclosure Template) with precise item-letter mapping (48(h)/(l)/(m), 43(f), Table 1).
1.4.02026-06-26Model validation page (Accra-2015 hindcast + parameter sensitivity), version stamp on outputs, environmental hardening (Ramsar/riparian-buffer/EIA), insurance & construction asset fields.
1.3.02026-06-26Knowledge Centre; NGFS scenario family; BoG return hardened with methodology-transparency block; Supervisor edition.
1.2.02026-06-26IPCC AR6 per-object scenarios + saturating projection; property-level adaptation with evidence gating; realistic localities; cost recalibration.
1.1.02026-06-25Accounts & saved portfolios; on-prem/air-gap; calibration framework; finance v2 (AAL → repricing → climate ECL).
1.0.02026-06-24Initial release — six-hazard screen, dashboard, board report, BoG semi-annual return.
Limitations (declared). This is a screening hindcast at locality resolution, not a parcel-level depth-damage back-test; financial constants are illustrative until calibrated to a bank's loss data; the model does not yet observe construction quality or insurance status unless recorded per asset; and an independent third-party technical review is recommended before regulatory reliance. The gap register on every board report lists what remains and who must close it.
PortfolioCheck methodology · Dr. Minka Aduse-Poku · PortfolioCheck v2.8.2 (2026-08-11) · Validation is screening-grade — it feeds, and does not replace, a bank's IFRS 9 / PD-LGD model validation.