What is a model inventory, and what must it contain?
By Nick Jang, founder of MINERVA Studio ·
The short answer
A model inventory is an institution’s register of every model it uses, plus those recently decommissioned: one row a model, with an identifier, owner, developer, risk rating, purpose, status and review dates. OSFI’s E-23 sets the fields in its Appendix 1 and expects vendor and AI models to be in it. It is the starting point of model risk management, because a model nobody listed is a model nobody controls.
Model inventory, not inventory model
A quick note, because search engines mix the two. An inventory model in operations research is a formula for how much stock to hold, such as the economic order quantity. A model inventory in banking is a list of models. This page is about the second.
The fields OSFI E-23 asks for
E-23 splits the inventory in two. Every model the institution has identified needs a short record; every model it has brought fully under its framework, the inventoried ones, needs more. The table follows Appendix 1, in our words.
| For | Fields |
|---|---|
| Every identified model | Model ID; name and description; risk rating; owner; developer; origin (in-house or vendor). |
| Every inventoried model, in addition | Version; deployment date; reviewer; approver; dependencies (models and systems it relies on or feeds); data sources; approved uses; limitations and exceptions; date of last review; monitoring status; next review date. |
Two things are easy to miss. Models recently decommissioned stay in the inventory, and third-party models are inventoried and rated on their own, not folded into the vendor’s contract record.
How to build one: finding the models
Almost nobody starts from a blank page. There’s usually a spreadsheet the model risk team has kept for years. The trouble is the models that never made it onto that spreadsheet. Here’s where they tend to hide:
- An attestation round. Ask every business and function head to list the models their teams build, buy or rely on, against a clear definition.
- Code and platforms. Search data science repositories, model registries such as MLflow, and scheduled jobs for anything that trains or scores.
- Vendor contracts. Read the third-party register for products that score, rank, forecast or generate: credit bureaus, fraud tools, CRM add-ons, document AI. B-10 work and the model inventory should meet here.
- End-user computing. Large spreadsheets with estimation logic, often in finance and treasury.
- AI use. Generative AI tools and agents adopted by teams, which E-23 and OSFI’s AI bulletin both expect to be known.
Then rate each model, assign an owner and set review dates from the rating. Expect the first pass to leave gaps; the useful thing is to know which fields are still owed for which model.
Spreadsheet or software?
A spreadsheet is a perfectly good place to start, and E-23 doesn’t require software. The problems show up a year in. Rows go stale. Nobody can say who changed a rating, or when. And the spreadsheet can’t stop anything: a model goes live without review and the inventory only finds out afterwards. Then an examiner asks for the history behind one row and you spend a week digging through email.
Software earns its place when the inventory needs to be current, attributed (every change with a name and a date) and connected to the reviews, approvals and monitoring each row points to. MINERVA imports the spreadsheet an institution already keeps, maps it to E-23’s fields and names every field still owed, model by model. See the E-23 platform.
Free template
Our E-23 model inventory template is a CSV with one column per Appendix 1 field and a help line on each. No sign-up. More templates, including an AI agent policy and an AI vendor due-diligence checklist, are on the templates page.
Related questions
Is a model inventory required under OSFI E-23?
Yes. E-23 expects every model in use or recently decommissioned to be identified and tracked, with the fields set out in its Appendix 1.
Do vendor models go in the model inventory?
Yes. E-23 asks for third-party models to be inventoried and risk-rated on a standalone basis.
Should AI tools be in the model inventory?
AI and machine-learning models meet E-23’s definition of a model, so yes. Many institutions also keep an AI system inventory that links agents and AI tools to the models inside them.
How often should the inventory be updated?
Continuously, as models are built, changed, reviewed and retired, with a periodic attestation by owners that their entries are accurate.
What is the difference between a model inventory and a model registry?
A registry (such as MLflow’s) tracks technical versions and artifacts for engineers. An inventory is the risk record: owner, rating, reviews, approvals and limits. They should be linked.
Sources
New answers are posted on MINERVA on LinkedIn. Follow along, or send the question you’d like answered next to minerva@minerva.studio.
A plain-language explanation, not legal advice. The regulator’s own text is the source; read it, and take advice on how it applies to your institution.