What is model risk?
By Nick Jang, founder of MINERVA Studio ·
The short answer
Model risk is the risk of loss or harm when a decision relies on a model that is wrong, or on a right model used for the wrong job. OSFI’s Guideline E-23 defines it as the risk of adverse financial, operational or reputational consequences arising from the design, development, deployment or use of a model. It comes from bad data, flawed methods, broken implementation and misuse, and it grows with how much rides on the output.
Two ways a model goes wrong
Every model is a simplification, so every model is wrong somewhere. Model risk is about whether that somewhere matters. It shows up in two forms.
- The model is wrong. The data was biased or stale, the method doesn’t fit the problem, an assumption stopped holding, or the code has a bug. The output is off even when everyone uses it exactly as intended.
- The model is used wrong. A sound model gets applied outside the conditions it was built for: a credit score built on prime borrowers used on subprime ones, a pricing model kept running long after the market changed, a forecast read as a certainty instead of an estimate.
The second one is the sneakier of the two. Nothing in the model breaks, so no alarm goes off.
Where model risk comes from
| Source | What it looks like |
|---|---|
| Data | Missing, mislabelled or unrepresentative data; a training period that doesn’t look like today. |
| Method | A technique that doesn’t suit the problem, or assumptions nobody wrote down. |
| Implementation | A coding or spreadsheet error, a wrong parameter, a manual step that gets skipped. |
| Use | Applying the model to a product, market or customer group it wasn’t built for. |
| Change over time | Drift: the world moves and the model’s accuracy quietly decays. |
| Opacity | A model nobody can explain, so nobody notices when it starts saying strange things. |
| Vendor models | A model inside bought software that the institution can’t see into but still relies on. |
AI raises several of these at once. Machine-learning models are harder to explain, drift faster and are often supplied by a vendor, and a generative model can produce a confident wrong answer that reads as well as a right one.
Three examples
JPMorgan’s London Whale (2012). The bank’s Chief Investment Office lost about US$6.2 billion on a synthetic credit portfolio. Its own task force found that a new value-at-risk model, adopted in early 2012, ran on spreadsheets with manual steps, and that a formula error made the portfolio look less risky than it was. The model didn’t cause the trades, but it lowered the number that was supposed to stop them.
Zillow Offers (2021). Zillow used its pricing models to buy homes directly, planning to resell them. In November 2021 it shut the business down, wrote down about US$304 million of inventory in a single quarter and cut roughly a quarter of its staff. The company said it had been unable to forecast home prices accurately, in both directions, by much more than it had modelled as possible.
The UK’s exam algorithm (2020). With exams cancelled, England’s exam regulator used a statistical model to adjust teachers’ predicted A-level grades. About 39% of grades came out lower than teachers had predicted, and students at larger state schools were hit harder than those in small private classes. Within days the results were withdrawn and teachers’ grades were used instead. The model did roughly what it was designed to do. The design hadn’t thought hard enough about who would bear the errors.
Each case has the same shape: an output people relied on, a weakness nobody had challenged hard enough, and a cost that landed somewhere else.
How institutions manage it
You can’t remove model risk without removing the model, so the aim is to know where it is and keep it proportionate to what’s at stake. That is model risk management, and under OSFI’s E-23 it follows a familiar pattern:
- keep an inventory of every model, vendor models and AI included;
- give each one a risk rating based on how much it matters and how uncertain it is;
- have someone independent validate it before it is relied on, with more scrutiny for higher ratings;
- approve its use, monitor it in production and review it on a cycle;
- write down the limits, the overrides and the reasons.
Some banks also hold a buffer for it, an adjustment to an estimate or extra capital, where a model’s uncertainty is known but can’t be fixed in time.
Related questions
What is the definition of model risk?
The risk of adverse financial, operational or reputational consequences from the design, development, deployment or use of a model. In short, the risk that a decision relies on a model that is wrong or used for the wrong purpose.
What is an example of model risk?
JPMorgan’s 2012 London Whale loss, where a spreadsheet-based value-at-risk model with a formula error understated the risk of a large credit portfolio, is the classic banking example.
Is model risk a type of operational risk?
It overlaps with operational risk, especially for implementation errors, but regulators such as OSFI treat it as its own risk with its own guideline, E-23, because it also affects credit, market and strategic decisions.
How is model risk measured?
Usually by a risk rating per model, combining how much depends on the output with how uncertain the model is, plus validation findings, monitoring results and, at some banks, a quantified adjustment or capital buffer.
Does AI increase model risk?
Often. AI models can be harder to explain, more sensitive to data drift and more often supplied by a vendor, which makes their errors harder to spot and to challenge.
Sources
- OSFI — Guideline E-23, Model Risk Management (2027)
- Harvard Law School Forum on Corporate Governance — The JP Morgan “Whale” Report (on the bank’s January 2013 task force report)
- Zillow Group — Form 8-K, third-quarter 2021 results (SEC)
- Wikipedia — 2020 United Kingdom school exam grading controversy
- Federal Reserve — SR 26-2, Revised Guidance on Model Risk Management
New answers are posted on MINERVA on LinkedIn. Follow along, or send the question you’d like answered next to minerva@minerva.studio.
A plain-language explanation, not legal advice. The regulator’s own text is the source; read it, and take advice on how it applies to your institution.