What is model risk governance?
By Nick Jang, founder of MINERVA Studio ·
The short answer
Model risk governance is the part of model risk management that decides who is accountable for what. It sets the roles (board, senior management, model owner, developer, independent reviewer, approver), the policy and standards they work to, the committees that make decisions, and the reporting that tells the board how much model risk the institution is carrying. OSFI’s E-23 names these roles and expects them defined, independent where it matters, and covering every model from development to retirement.
Governance versus management
Model risk management is the whole job: inventory, rating, validation, monitoring. Governance is the frame around it. It answers who may build a model, who may check it, who may approve it, who gets told when it goes wrong, and who can switch it off.
When governance is weak, the work still gets done, after a fashion. Models are built, someone glances at them, they go live. What’s missing is the ability to show, months later, who decided and why. That’s exactly what an examiner asks for.
The roles E-23 names
| Role | Responsible for |
|---|---|
| Board of directors | Receiving appropriate reporting on model risk from senior management, and overseeing it as part of the risk appetite. |
| Senior management | Defining and applying roles, accountabilities and expectations for model risk management across the enterprise. |
| Model owner | Coordinating development, implementation, deployment and ongoing monitoring; the person accountable for the model. |
| Model developer | Designing, developing, evaluating and documenting the methodology. |
| Model reviewer | Reviewing conceptual soundness, inputs, methodology, assumptions and performance, independently of development. |
| Model approver | Holding the authority to approve the model’s use. |
Two rules hold the structure together. The review must be independent of development: the person who built a model can’t be the one who signs off its soundness. And approval must sit with someone who has the authority to accept the risk, not just whoever is available.
The pieces of a governance framework
- A model risk policy, approved by senior management, that defines a model, sets the roles, and says what has to happen before a model is used.
- Standards for development, documentation, validation, monitoring and decommissioning, scaled by risk rating.
- A model risk rating approach, so the heaviest scrutiny lands on the models that matter most.
- A model inventory that records owner, developer, reviewer and approver for each model.
- Decision forums: often a model risk committee for high-rated models, with delegated authority for the rest.
- Exceptions and limits: how a model can be used with an open finding or before full validation, with conditions and an end date.
- Reporting to senior management and the board: how many models, their ratings, overdue reviews, open findings, breaches.
Most banks hang this on the three lines of defence. The first line (business and model owners) owns the models, the second line (model risk management) sets standards and challenges, and internal audit, the third line, checks the whole thing works.
Where governance usually breaks
- The same person shows up as developer and reviewer on a model nobody else understands.
- Approvals happen by email and live in someone’s inbox.
- Exceptions are granted with no end date and quietly become permanent.
- Vendor and AI models sit outside the inventory, so none of the roles are filled.
- The board sees a count of models but not which ones are high risk and overdue.
Each of these is fixable with a record that won’t let it happen. MINERVA keeps the roles on every model, refuses an approval when the developer is also the reviewer or approver, refuses it while required validation evidence is missing or a high-severity finding is open, and prints the board report from the same record. See OSFI E-23 software.
Related questions
What is the difference between model risk governance and model risk management?
Model risk management is the whole discipline of controlling model risk. Governance is the part that sets roles, authority, policy, committees and reporting, so decisions about models are made by the right people and recorded.
Who is responsible for model risk governance?
Senior management defines and applies the roles and accountabilities and reports to the board. Model owners, developers, independent reviewers and approvers each carry their part for individual models.
Does a model risk committee have to approve every model?
No. Most institutions send high-rated models to a committee and delegate approval of lower-rated ones to named individuals, as long as the approver has the authority and the review was independent.
Can a model developer approve their own model?
Under E-23 the review must be independent of development, and good practice keeps developers from reviewing or approving their own models.
Is model risk governance a good career?
Yes. With AI models added to every inventory and E-23 in force from 1 May 2027, governance roles in model risk teams are growing.
Sources
- OSFI — Guideline E-23, Model Risk Management (2027)
- OSFI — Corporate Governance Guideline
- Federal Reserve — SR 26-2, Revised Guidance on Model Risk Management
New answers are posted on MINERVA on LinkedIn. Follow along, or send the question you’d like answered next to minerva@minerva.studio.
A plain-language explanation, not legal advice. The regulator’s own text is the source; read it, and take advice on how it applies to your institution.