Skip to content
Glossary

Model risk management (MRM)

Model risk management is the framework a bank uses to identify, govern, validate and monitor its models so that decisions based on model outputs remain sound.

Model risk is the potential for adverse consequences from model errors or from the inappropriate use of model outputs in business decisions. Model risk management (MRM) controls this risk across the whole model lifecycle: identification, development, independent validation, approval, use, monitoring and decommissioning. The PRA and BaFin use closely aligned definitions of a model as a quantitative method, system or approach that applies statistical, mathematical or similar theories and assumptions to turn input data into output; the definition originates in US supervisory guidance (SR 11-7).

For the board, model risk is a risk in its own right, not a technical detail. Credit decisions, pricing, provisioning, capital planning, financial crime alerts and, increasingly, AI applications depend on models. The PRA expects the board to set a model risk appetite and to receive regular reports on the model risk profile. FINMA observed in its 2024 guidance on AI that institutions focus on data protection but pay less attention to model risks such as lack of robustness, bias and explainability. In the EU, AI systems that assess the creditworthiness of natural persons are classified as high-risk under the AI Act.

Common weaknesses are a definition of a model that is too narrow, so that spreadsheets, vendor tools and AI applications escape the framework; validation that only re-runs calculations instead of challenging assumptions; and post-model adjustments that become permanent instead of triggering redevelopment.

In practice

  1. 01
    Maintains one firm-wide definition of a model and a complete inventory, including vendor models and AI applications.
  2. 02
    Tiers every model by materiality and complexity and sets validation depth and frequency by tier.
  3. 03
    Keeps validation organisationally independent of model developers and owners, with a direct escalation route to the board or its committees.
  4. 04
    Reports the model risk profile against a board-approved model risk appetite, including open findings and post-model adjustments.
  5. 05
    Assigns accountability for the framework to a named member of senior management.
In MRM-Solution

How MRM-Solution supports it

  1. 01Keep every model in one inventory with owner, tier, EU AI Act risk class and re-validation dates, linked to the committees that approve its use.
  2. 02Generate policies from the modelled processes, so roles and responsibilities in the text match how the work is actually done.
Book a demo

Sources

Too good to be true? Then we should talk.

30 minutes. Your use case, maximum impact.

info@mrm-solution.com
Area of interest