Model Risk Management

Model risk management is the discipline of identifying, measuring, and controlling the risk that a statistical, machine learning, or AI model produces materially wrong or misleading results that lead to financial or business harm.

A model risk management program is typically built around four components. A model inventory documents every model in use and its intended purpose. Independent validation, performed by a team separate from the one that built the model, checks its data, assumptions, and performance before deployment and at set intervals afterward. Documented assumptions and limitations explain what a model was built to do, what it was not, and where it is likely to break. Ongoing monitoring watches for performance drift as data or business conditions change over time.

Model risk management has historically applied most heavily to models used for financial risk, capital, credit, and pricing decisions inside banks. As institutions add machine learning and AI models throughout the business, the practice is being extended to a wider footprint, though not automatically or uniformly. In US banking, SR 26-2 is the current supervisory guidance on this, replacing the retired SR 11-7, and it requires that the four components above be documented and defensible rather than followed informally. SR 26-2 also draws an important boundary: generative and agentic AI systems fall outside traditional model risk scope, so a mature model risk program does not automatically cover those systems. They need a dedicated AI governance approach instead.

Good model risk management depends on being able to answer basic questions with evidence: what model is this, what data feeds it, has that data or the model itself changed since it was last validated, and would the institution know if it had. That last question is where many institutions are weakest. A model inventory and a validation report are point in time documents, and they do not automatically stay accurate as upstream data pipelines, source tables, and application code change around a model over time.

How model risk management relates to SR 26-2 and AI governance

SR 26-2 is the specific, current supervisory guidance that defines model risk expectations for US banks. AI governance is the parallel discipline institutions need for generative and agentic AI systems, which SR 26-2 excludes from traditional model risk scope. AI explainability supports both: a model or AI system that cannot be explained is difficult to validate or monitor with any confidence.

Where Model Risk Management Actually Starts

For a compliance or governance leader, the hardest part of model risk management is rarely writing the policy. It is keeping the model inventory and validation record accurate as the real data pipelines and application code behind each model keep changing. Continuously mapping the actual data sources and code paths feeding a model, through source code analysis rather than periodic documentation, keeps validation and monitoring aligned with what is really running rather than what was documented at approval time. That kind of documented, verifiable record of what data and logic fed a model is what lets reviewers move through regulatory approval faster.

Related glossary terms

• SR 26-2
• AI Governance
• AI Explainability
• Data Provenance

Frequently asked questions

What are the core components of a model risk management program?

Most programs are built around four things: a model inventory listing every model in use and its purpose, independent validation performed by a team separate from the one that built the model, documented assumptions and known limitations for each model, and ongoing monitoring for performance drift after deployment. Regulators generally expect all four to be documented well enough that an examiner can reconstruct why a model was approved and how its risk is being tracked.

Does model risk management cover AI models the same way it covers traditional statistical models?

Partially. Traditional statistical and machine learning models used for things like credit scoring or pricing generally fall within model risk management as it has always worked. Generative and agentic AI systems are different. Under SR 26-2, they are explicitly excluded from traditional model risk scope, so institutions need a separate, dedicated AI governance program for those systems rather than assuming existing model risk processes apply.

How does data lineage support model risk management?

Model validation depends on knowing exactly what data feeds a model and whether that data has changed. Lineage that traces a model's inputs back to their original source, through every transformation along the way, gives a model risk team a current, verifiable answer instead of relying on documentation that goes stale as pipelines change. That makes ongoing monitoring and periodic revalidation faster and more defensible during an exam.