Model Risk Management (MRM)

The foundational process of cataloging all models within an institution and assigning a risk tier based on materiality and complexity. This ensures that high-risk models—such as those directly impacting capital reserves or fraud blocking decisions—receive proportionally rigorous oversight. A complete inventory prevents shadow models from operating outside governance controls. Key activities include:

• Defining what constitutes a 'model' vs. a tool
• Assessing financial, reputational, and operational impact
• Applying tiered validation schedules based on criticality

Continuous automated surveillance of model inputs, outputs, and the environment to detect degradation. This pillar operationalizes the detection of Data Drift and Concept Drift. For financial fraud, monitoring tracks feature distributions (e.g., transaction velocity) and prediction distributions. Thresholds trigger alerts when a model's performance deviates from its validated baseline, initiating a review or automatic rollback to a stable Champion-Challenger variant.

The structural scaffolding that ensures accountability and auditability. This includes maintaining a comprehensive Model Documentation artifact as the single source of truth, enforcing a Model Attestation cadence where owners annually re-certify fitness for purpose, and preserving an immutable Audit Trail. For regulated entities, this pillar directly maps to SR 11-7 expectations, demonstrating to examiners that a sound control environment exists.

Empirical validation techniques that compare predictions against reality. Backtesting measures historical accuracy over a defined window to identify systematic bias. Stress Testing simulates extreme but plausible scenarios—such as a coordinated fraud attack during a market crash—to assess model resilience beyond normal conditions. These exercises quantify potential financial loss and validate that loss reserves are adequate.

The extension of the MRM framework to externally sourced models, including SaaS fraud scores and black-box AI services. Due diligence requires evaluating the vendor's own development, validation, and data practices. Institutions must ensure that procured models meet the same rigorous internal governance standards, including Explainability requirements and Disparate Impact Testing, to avoid inheriting unmanaged risk from the supply chain.