Model risk management
MRMAlso called model governance, model risk governance
Model risk management is the framework a firm uses to control the risk of loss from models that are wrong or used wrongly. It covers how models are built, approved, validated, monitored and retired. Banks apply it to credit, capital, pricing, financial crime and AI models alike.
How it works
A bank keeps an inventory of every model and tiers each one by materiality and complexity. Developers document data, assumptions and limits. An independent validation team tests the model before use and at set intervals. Owners monitor performance, and a model risk committee approves use, limits and remediation. Internal audit checks that the framework itself works.
Models now drive lending, capital, fraud alerts and customer decisions. A faulty model can misprice risk, understate capital or miss crime at scale. Supervisors in the US and UK expect a board-approved framework with clear ownership. The spread of machine learning and generative AI has widened what firms count as a model and how they test it.
The rules
Replaces SR 11-7 and SR 21-8 as the Federal Reserve's guidance on managing model risk.
Federal Reserve-supervised banking organisations, mainly those with over $30 billion in assetsSets five principles covering model identification, governance, development, independent validation and risk mitigants.
UK banks, building societies and PRA-designated investment firms with internal model approvalCommon questions
What counts as a model?
Supervisors define a model broadly as a quantitative method that turns input data into estimates or decisions. This includes statistical, machine learning and AI tools. Many firms also bring spreadsheets and vendor tools into scope when they drive material decisions.
Who owns model risk at a bank?
Model owners in the business are accountable for their models. A second-line model risk function sets standards and runs independent validation. Under PRA SS1/23 a senior manager takes overall responsibility for the framework.
What replaced SR 11-7?
The Federal Reserve issued SR 26-2 on 17 April 2026. It superseded SR 11-7, the 2011 guidance that had shaped US model risk practice for over a decade, and SR 21-8.
Does MRM apply to AI models?
Yes. Supervisors expect AI and machine learning models to sit within the same framework. Firms add tests for explainability, bias, drift and data quality that classic statistical models rarely needed.
