What is model risk management software?
By Nick Jang, founder of MINERVA Studio ·
The short answer
Model risk management software is where a bank or insurer keeps the record of its models: the inventory, each model's risk rating, who built, reviewed and approved it, its validation results, findings, monitoring and the reports to senior management. Some tools go further and run tests or enforce approval rules; others are a module inside a wider GRC suite. Platforms Canadian institutions commonly look at include SAS Model Risk Management, IBM OpenPages, ValidMind, Yields and ModelOp. No regulator requires a particular tool; OSFI's E-23 asks for the outcomes, and the software is how most banks keep the evidence.
What it should do
| Capability | Why it matters |
|---|---|
| A complete inventory | Every model, in-house, vendor and AI, with the fields the regulator lists. E-23's Appendix 1 sets them for Canadian institutions. |
| Risk rating | Each model rated on clear criteria, and the rating sets how deep and how often the rest of the work is. See model risk tiering. |
| Lifecycle workflows | Development, independent review, approval, deployment, monitoring and decommissioning, with who did each step and when. |
| Separation of duties | The developer can't approve their own model; the reviewer is independent. Good tools enforce this rather than just record it. |
| Validation evidence | Test results, findings and remediation tied to the approval they support. |
| Monitoring and thresholds | Performance tracked against set limits, with breaches escalated to a person. |
| Reporting | Model risk reports for senior management and the board, and the evidence an examiner asks for. |
The kinds of tool
- Enterprise model risk suites, built for large banks, often part of an analytics platform.
- GRC platforms with a model risk module, good if the bank already runs risk and compliance there.
- Model documentation and validation tools, strong on running tests and writing validation reports.
- AI lifecycle governance platforms, aimed at machine learning, generative AI and agents.
- Spreadsheet and end-user computing tools, for finding and controlling the models nobody registered.
Many banks combine two: a system of record for the inventory and approvals, plus a tool where validators run tests.
Platforms banks look at
Each is described from its maker's own public pages as of 30 October 2026, not rated. Check each vendor's current materials before relying on any of it.
| Platform | Kind | What the maker says |
|---|---|---|
| SAS Model Risk Management | Enterprise model risk suite | One inventory with tools to document, review and validate models across the life cycle, and dashboards on model risk concentration for senior leaders; part of SAS Viya. |
| IBM OpenPages (Model Risk Governance) | GRC platform with a model risk module | Risk, compliance and audit in one system; the module adds traceable model workflows and reporting; any cloud or on premises. |
| ValidMind | Model documentation and validation | Publishes an E-23 implementation guide mapping the guideline to its inventory, documentation, validation and monitoring features. |
| Yields | Model risk management platform | An inventory with the attributes E-23 expects, tiering that sets review depth, lifecycle workflows, monitoring with escalation, and an audit trail. |
| ModelOp | AI lifecycle governance | A system of record for machine learning, generative, agentic and vendor AI that automates lifecycle management. |
| Mitratech ClusterSeven | Spreadsheet and EUC risk | Finds and oversees spreadsheets and similar files outside IT's control, with change tracking and risk scoring. |
For a fuller side-by-side, with links to each source, see OSFI E-23 platforms compared.
How to choose
- Start from the gap. If the inventory is the problem, a validation tool won't fix it. If validators drown in documentation, a GRC module won't either.
- Load your own models in the pilot. A demo inventory always looks clean; your spreadsheet with its gaps is the test.
- Ask how it handles AI and vendor models. E-23 covers both; some tools were built before either mattered.
- Ask what it refuses. Can a developer approve their own model? Can a model go live with an open high-severity finding?
- Ask how an examiner checks the record without trusting the vendor's report.
- Ask where it runs: Canadian hosting, your own data centre, or both, and in which languages.
A small institution with a few dozen models can run on a well-kept spreadsheet for a while. It usually stops working when several people edit it, approvals live in email, and the examiner asks who decided what.
Where MINERVA fits
MINERVA is the system of record and controls for OSFI E-23 and B-10: one inventory of models, AI systems, AI agents and vendors; approvals that refuse the model's own developer and wait for the evidence its rating calls for; and a time-stamped, hash-chained record an examiner can verify offline. It doesn't host validation compute; tests run where your data is and their results are recorded. Try the free model risk tier calculator, or see OSFI E-23 software.
Related questions
What is the best model risk management software?
It depends on the gap. Large banks often use an enterprise suite or a GRC module; teams focused on validation use documentation and testing tools; AI-heavy teams look at AI lifecycle platforms. Pilot with your own models before choosing.
Is model risk management software required by OSFI?
No. OSFI's E-23 is principles-based and names no software. It expects an inventory, ratings, independent review, approval and monitoring for every model, which most institutions find hard to evidence in spreadsheets.
What is SAS Model Risk Management?
SAS's model risk product, part of its Viya platform. SAS describes it as one inventory with tools to document, review and validate models across their life cycle, with dashboards for senior leadership.
What is IBM OpenPages?
IBM's governance, risk and compliance platform. Its Model Risk Governance module adds model workflows and reporting; IBM says it runs on any cloud or on premises.
What should model risk management software cover for AI?
AI and machine learning models in the same inventory, ratings that weigh autonomy and complexity, validation evidence for AI-specific risks such as bias and drift, and controls for AI agents that take actions.
Sources
- OSFI — Guideline E-23, Model Risk Management (2027)
- SAS — Model Risk Management
- IBM — OpenPages
- ValidMind — OSFI E-23 use case
- Yields — OSFI E-23
New answers are posted on MINERVA on LinkedIn. Follow along, or send the question you’d like answered next to minerva@minerva.studio.
A plain-language explanation, not legal advice. The regulator’s own text is the source; read it, and take advice on how it applies to your institution.