What is model risk management in banking?
By Nick Jang, founder of MINERVA Studio ·
The short answer
Model risk management is the set of controls a bank or insurer uses to manage model risk: the chance of loss or harm because a model is built on wrong assumptions, fed poor data, coded badly or used for something it was not built for. It rests on an inventory of every model, a risk rating, development standards, independent validation, approval by someone other than the builder, ongoing monitoring and orderly retirement.
What model risk is
Banks run on models, more than most customers realise. One model decides how much capital sits behind the mortgage book. Another sets the IFRS 9 loan-loss provision every quarter. A third picks which of yesterday’s million payments a compliance analyst should look at. A fourth sets your car insurance premium. Each one turns data into a number, and somebody acts on that number.
Model risk comes from two directions. Sometimes the model is simply wrong: a flawed method, a bug, data that stopped looking like the world. Other times it’s misused: pointed at customers or products it was never built for, or trusted further than its known limits. OSFI’s E-23 is clear that the damage isn’t only financial. A model that treats customers unfairly or misstates capital costs a bank its reputation and its standing with the regulator, too.
Why model risk management matters
The well-known failures are rarely exotic. In 2012 a change to a value-at-risk model at JPMorgan’s Chief Investment Office, built in spreadsheets with manual copy-and-paste steps, understated the risk of a trading position that went on to lose about US$6.2 billion; the bank’s own task force report, filed in January 2013, described the modelling errors. In 2021 Zillow shut its home-buying business after its pricing algorithm overpaid for houses and the company wrote down hundreds of millions of dollars of inventory.
Three things make MRM more pressing now than ten years ago:
- There are more models. Machine learning has spread into fraud, marketing, collections, underwriting and operations, often built outside the traditional modelling teams.
- More of them come from vendors, inside software a bank buys, where the institution sees less of how they work.
- Regulators have widened the scope. OSFI’s E-23, in effect from 1 May 2027, applies to every model including AI and machine learning, at every federally regulated institution. In the United States SR 26-2 replaced SR 11-7 in April 2026.
The parts of a model risk management framework
| Part | What it does |
|---|---|
| Policy and governance | Defines what a model is, who owns model risk, the risk appetite, and the roles of the board and senior management. |
| Model inventory | Lists every model in use or recently retired, with an owner and key facts. See what a model inventory is. |
| Risk rating (tiering) | Rates each model on its materiality, complexity and the impact of an error; the rating sets how much scrutiny it gets. |
| Development standards | Sets how models are built, tested and documented, including data quality and the limits of the method. |
| Independent validation | Someone independent of the builder challenges the model’s design, data and performance. See model validation. |
| Approval | A named approver decides whether the model may be used, knowing its rating, the review’s findings and its limits. |
| Monitoring | Tracks performance, inputs and use against thresholds, and escalates breaches. |
| Decommissioning | Retires models in an orderly way, keeps their record and watches for effects downstream. |
The rating is the hinge. A spreadsheet that estimates branch staffing and a model that sets regulatory capital can’t get the same treatment, and every framework OSFI or the US agencies describe lets the rating decide how deep each step goes.
Who does what: the three lines of defence
Most banks split model risk across three lines. The first line builds, owns and uses the models: business units and their model developers. The second line sets the MRM policy and challenges the first, usually a model risk management or validation team under the Chief Risk Officer. The third line, internal audit, checks that the whole system works.
The principle under the structure is separation. The person who built a model shouldn’t be the one who validates it, and neither should be the one who approves it alone. E-23 says review must be independent of development; good MRM software makes that separation impossible to skip rather than relying on people to notice.
What OSFI E-23 expects
E-23 sets three outcomes for Canadian federally regulated institutions: governance that holds model risk to the risk appetite, models that are fit for their purpose, and model risk that’s identified and managed across the whole life of every model. It asks for an inventory with set fields (its Appendix 1), a risk rating approach, proportional controls, data standards, independent review, approval, controlled deployment, monitoring and decommissioning. It names AI and machine learning inside its definition of a model. Our guide to E-23 goes principle by principle.
Where MINERVA fits
MINERVA keeps the MRM record for Canadian banks and insurers: the inventory in E-23’s fields, each model’s rating, owner, developer, reviewer and approver, validation results and findings, and monitoring. It refuses an approval by the model’s own developer, one without the validation evidence its rating calls for, and one while a high-severity finding is open. See the E-23 platform.
Related questions
What is the difference between model risk and model risk management?
Model risk is the possibility of harm from a model that is wrong or misused. Model risk management is the framework of people, policies and controls that keeps that risk within the institution’s appetite.
Who is responsible for model risk management in a bank?
The board approves the appetite and senior management owns the framework. Model owners in the business are accountable for their models; a second-line MRM or validation team challenges them; internal audit reviews the whole.
Is model risk management required by law in Canada?
OSFI’s Guideline E-23 sets the expectations for federally regulated institutions from 1 May 2027. Guidelines are supervised against rather than enforced in court, but institutions treat them as required. Quebec’s AMF has its own model risk guideline.
Is model risk management a good career?
Demand has grown with the spread of machine learning and the new guidance in Canada and the US. Roles mix statistics, programming, finance and judgement, and validators with AI experience are especially sought after.
What is model risk governance?
The part of MRM that sets roles, policies, the risk appetite and reporting: who owns each model, who approves, who challenges and what the board hears.
Sources
- OSFI — Guideline E-23, Model Risk Management (2027)
- Federal Reserve — SR 26-2, Revised Guidance on Model Risk Management
- Harvard Law School Forum on Corporate Governance — The JP Morgan “Whale” Report (on the bank’s January 2013 task force report)
New answers are posted on MINERVA on LinkedIn. Follow along, or send the question you’d like answered next to minerva@minerva.studio.
A plain-language explanation, not legal advice. The regulator’s own text is the source; read it, and take advice on how it applies to your institution.