What is model risk management?
Model risk management is the governance used to identify, assess and control the possibility that a statistical, machine-learning or other analytical model produces unreliable results or is used incorrectly. Model risk can arise from flawed assumptions, unsuitable data, implementation errors, drift, poor interpretation or use outside the model’s intended context.
The framework is common in financial services but applies more broadly wherever models influence material decisions. It covers the complete lifecycle from development and approval to monitoring, change and retirement.
What creates model risk?
Risk may originate in data quality, representativeness, labels, feature design, methodology, code, validation or integration. Even a technically sound model can create risk when users misunderstand the output or treat a probability as a certainty.
External models create additional challenges because the organisation may have limited visibility over training, updates and limitations. Vendor documentation should be reviewed against the organisation’s own use.
What controls are used?
Core controls include a model inventory, clear ownership, risk classification, independent validation, documentation, performance thresholds, change management, access restrictions and issue tracking. Material models may require approval by a risk committee or senior leader.
Validation should examine conceptual soundness, data, implementation, performance, limitations and outcomes. Independence helps challenge assumptions made by developers or business sponsors.
How are models monitored?
Monitoring may track accuracy, stability, drift, subgroup performance, overrides, complaints, incidents and changes in input data. Thresholds should define when investigation, recalibration, restriction or suspension is required.
Model retirement should address dependencies, retained evidence, data, replacement decisions and communication to users. A model that is no longer supported should not remain embedded unnoticed in a process.
Frequently asked questions
Is model risk management the same as AI governance?
It overlaps but is narrower. AI governance covers wider organisational, legal and ethical issues, while model risk management focuses strongly on model reliability and use.
Does every model need independent validation?
The level of independence should be proportionate. High-impact models normally require stronger challenge than low-risk analytical tools.
What is model drift?
It is a change in data patterns or relationships that causes performance or assumptions to deteriorate over time.
Who owns a model?
A named business owner should be accountable for use and outcomes, supported by technical developers, validators and risk functions.
Can spreadsheet models create model risk?
Yes. Complexity, hidden formulas, manual inputs and material decisions can create significant risk regardless of the technology used.