Is model risk an operational risk?
By Nick Jang, founder of MINERVA Studio ·
The short answer
Partly. Some model failures are classic operational risk: a coding error, a bad data feed, a spreadsheet nobody checked. But model risk also covers a correct model used for the wrong decision, and those losses show up as credit, market or strategic losses rather than operational ones. That's why OSFI gives model risk its own guideline, E-23, and many banks manage it as a risk in its own right that sits next to operational risk.
The two definitions side by side
| Source | Definition, paraphrased |
|---|---|
| OSFI capital rules (CAR, Chapter 3), following Basel | Operational risk is the risk of loss from inadequate or failed internal processes, people and systems, or from external events. It includes legal risk and excludes strategic and reputational risk. |
| OSFI Guideline E-21 | Operational risk is the risk of loss from people, inadequate processes and systems, or external events. |
| OSFI Guideline E-23 | Model risk is the risk of adverse financial, operational or reputational consequences from the design, development, deployment or use of a model. |
| EU Capital Requirements Directive, Article 3(1)(11) | Model risk is the potential loss from decisions based mainly on internal models, due to errors in their development, implementation or use. |
Read them together and the overlap is obvious. A failed process or system can break a model. But E-23's wording goes further: the consequences can be financial or reputational, and reputational risk is exactly what the operational risk definition leaves out.
Where they overlap, and where they don't
- Clearly operational: a formula error in production code, a data pipeline that silently drops records, a model run on the wrong version, a vendor model changed without notice. These are failures of processes, people or systems.
- Not really operational: a well-built credit model used to approve a product it was never designed for; a model whose assumptions held for ten years and then stopped holding; a sound model whose limits nobody told the decision-makers about. Nothing failed in the operational sense. The judgement around the model did.
The second group is why model risk teams exist. An operational risk team asks whether the control ran. A model risk team asks whether the model should be trusted for this use, at all, today.
How banks usually place it in the risk taxonomy
There's no single answer, and supervisors don't force one. Three patterns are common:
- A risk of its own, with its own appetite, policy and owner (often a head of model risk reporting to the CRO). It's the pattern that maps most directly onto E-23.
- A sub-risk of operational risk, reported through the operational risk framework but with a separate model risk policy and validation function. Common where the operational risk function is strong and the model estate is small.
- A cross-cutting risk that's mapped to whichever risk the model drives: a credit model's errors count as credit risk, a trading model's as market risk.
Whichever you pick, the test is the same: does every model have an owner, a risk rating, an independent review and a record of who approved its use? If the taxonomy decision leaves models in a gap between two teams, it's the wrong decision.
Why it matters for capital and reporting
Operational risk losses feed operational risk capital and loss data. If a model error causes a loss, someone has to decide which bucket it lands in, and banks that haven't decided end up counting the same loss twice or not at all. Write the rule down in the risk taxonomy and the loss-data standards, and give model risk its own flag so you can still find those losses later.
Under E-23, which applies from 1 May 2027, OSFI expects model risk to be managed across the whole model lifecycle. Folding it into operational risk works only if the result still does that. See what E-23 asks for.
Where MINERVA fits
MINERVA keeps the model risk record OSFI E-23 asks for: the inventory, each model's rating, its reviewer and approver, and every decision on a time-stamped trail, whichever box your taxonomy puts model risk in. See the E-23 platform.
Related questions
Does OSFI treat model risk as operational risk?
OSFI gives model risk its own guideline, E-23, and E-21 on operational risk doesn't fold it in. Institutions decide where it sits in their own taxonomy, as long as E-23's expectations are met.
Is model risk included in operational risk capital?
Losses caused by model errors can show up in operational risk loss data, depending on how the bank classifies them. Model risk as a whole has no separate Pillar 1 capital charge.
Who owns model risk in a bank?
Usually the business that uses the model owns it day to day, a model risk function in the second line sets the policy and reviews models, and internal audit checks both.
Is AI risk the same as model risk?
AI systems are models under E-23, so their risk is model risk, plus some new risks, such as data leakage or prompt injection, that also touch operational and cyber risk.
Sources
- OSFI — Capital Adequacy Requirements (CAR) (2024), Chapter 3, Operational Risk
- OSFI — Guideline E-21, Operational Risk Management and Resilience
- OSFI — Guideline E-23, Model Risk Management (2027)
- Directive 2013/36/EU (Capital Requirements Directive), Article 3
New answers are posted on MINERVA on LinkedIn. Follow along, or send the question you’d like answered next to minerva@minerva.studio.
A plain-language explanation, not legal advice. The regulator’s own text is the source; read it, and take advice on how it applies to your institution.