Model inventory

The model inventory is the foundation of model risk management: a model that is not in the inventory is not validated, monitored or reported. The PRA expects a firm-wide inventory of all models implemented for use, under development or decommissioned. It records purpose and intended use, assumptions and limitations, validation findings and governance details such as the people responsible and the dates of the last and next validation.

For executives, the inventory is the only reliable answer to three questions: how many models the bank relies on, which of them matter most, and where open findings sit. FINMA’s guidance on AI expects institutions with many or significant applications to keep a centrally managed inventory with a risk classification, and notes that completeness was a challenge because AI use is spread across the organisation.

Typical gaps are spreadsheet and vendor models that were never registered, generative AI tools used outside formal projects, and inventories kept per business line without a consolidated view. Inventories also lose value when they hold static descriptions but not the dependencies between models.

In practice

1. 01
   Defines clear inclusion criteria and has business lines confirm periodically that all their models are registered.
2. 02
   Records owner, users, purpose, tier, validation dates, open findings and known limitations for each model.
3. 03
   Captures dependencies between models and the data that feeds them.
4. 04
   Includes vendor models, end-user computing tools with estimation logic and AI applications.
5. 05
   Uses stable model identifiers that never change, so findings and reports remain traceable over time.

Sources

• PRA Supervisory Statement SS1/23, Model risk management principles for banks (updated April 2026) →
• FINMA Guidance 08/2024, Governance and risk management when using artificial intelligence, 18 December 2024 →