What is model risk tiering?
By Nick Jang, founder of MINERVA Studio ·
The short answer
Model risk tiering is sorting your models into a few levels, often high, medium and low, by how much harm each could do if it were wrong or misused. The tier then sets how hard you look at the model: how deep the validation, how often it’s reviewed, who must approve it and how closely it’s monitored. OSFI’s E-23 calls this the model risk rating (Principle 2.2) and expects it to rest on quantitative factors, such as the size of the portfolio the model covers, and qualitative ones, such as complexity, autonomy, data reliability and customer impact.
Why tier at all
A bank can have hundreds of models. Giving every one the full treatment, an independent validation every year with a committee approval, would swamp the validation team and slow everything down. Giving every one a light touch would leave the capital and credit models under-checked.
Tiering is how you spend scrutiny where the risk is. It also makes the decisions defensible: when an examiner asks why a model was reviewed lightly, the answer is its rating and the factors behind it.
The factors E-23 names
E-23 asks for a rating based on inherent model risk, before controls, reflecting both how vulnerable the model is and how material its impact would be. It names these factors:
| Kind | Factors |
|---|---|
| Quantitative | The importance, size and growth of the portfolio the model covers; potential operational, security or financial impact. |
| Qualitative | Business use or purpose; model complexity or level of autonomy; reliability of data inputs; customer impact; regulatory risk. |
Autonomy is the one to watch with AI. A model whose output a person reviews before anything happens is a different risk from one that acts on its own, even if the maths is identical.
The US agencies’ SR 26-2 (17 April 2026), which replaced SR 11-7, takes the same line: the rigor of testing and validation should scale with a model’s materiality and complexity.
A worked example
E-23 doesn’t prescribe a formula, so each institution builds its own. Here’s one simple shape, for illustration only: score each factor from 1 (low) to 3 (high), add them up, and map the total to a tier.
| Factor | Score | Why |
|---|---|---|
| Portfolio size and impact | 3 | Decides limits on a large card book. |
| Customer impact | 3 | Directly affects who gets credit. |
| Complexity | 2 | Gradient-boosted trees, explainable with effort. |
| Autonomy | 2 | Automatic decisions within limits; referrals go to a person. |
| Data reliability | 1 | Bureau and internal data with long histories. |
| Regulatory risk | 3 | Credit decisions draw fair-lending and conduct scrutiny. |
| Total | 14 of 18 | High tier (say, 13 or more). |
To try it on your own model, use the free model risk tier calculator. Many institutions add overrides: any model used for regulatory capital, or any model making automatic decisions about customers, can’t sit below a set tier, whatever its score.
What the tier should change
E-23 (Principle 2.3) lists what the rating should drive: the frequency, intensity and scope of model review; documentation requirements; the level of authority needed to approve the model; the frequency, intensity and scope of monitoring; and how often the rating itself is re-assessed. A typical setup, again only as an example:
| What it sets | High tier | Medium tier | Low tier |
|---|---|---|---|
| Validation before use | Full independent validation | Targeted independent review | Review by a qualified peer |
| Periodic review | Every year | Every two years | Every three years |
| Approval | Model risk committee | Head of model risk | Model owner’s manager |
| Monitoring | Monthly, with thresholds | Quarterly | Annual check |
| Re-rating | Every year or on any trigger | Every two years or on a trigger | On a trigger |
If two tiers trigger exactly the same work, you don’t really have two tiers.
Where tiering goes wrong
- Tiering the method, not the use. The same logistic regression is low risk in a marketing test and high risk in credit adjudication.
- Rating vendor models low because someone else built them. The risk is in your use of it, whoever wrote the code.
- Never re-rating. A model that started in one product and spread to three has a different rating than it had at launch.
- Letting the owner rate their own model unchallenged. The second line should check the rating, because a lower tier means less work for the owner.
- Ignoring autonomy for AI: a model that now acts without review deserves a fresh look.
MINERVA records the rating factors on each model and works out its review and monitoring dates from the tier, so a change in tier changes the schedule. A change to a recorded rating is proposed and decided by a second person, not edited in place. See OSFI E-23 software.
Related questions
What is the difference between model risk tiering and model risk rating?
They mean the same thing in practice. OSFI’s E-23 says model risk rating; many banks call the resulting levels tiers.
How many model risk tiers should there be?
Most institutions use three or four. What matters is that each tier triggers different work: deeper validation, more frequent review and a more senior approver as the tier rises.
What factors determine a model’s risk tier?
Under OSFI E-23: quantitative factors such as the size and importance of the portfolio and potential financial or operational impact, and qualitative ones such as business use, complexity, autonomy, data reliability, customer impact and regulatory risk.
How often should model risk tiers be reviewed?
E-23 expects ratings to be reviewed when a trigger event occurs, and the rating itself sets how often it is re-assessed. Higher-rated models are usually re-rated at least once a year.
Is model risk tiering based on inherent or residual risk?
E-23 asks for a rating based on inherent model risk, before controls. Residual risk then informs usage limits, monitoring intensity and other controls.
Sources
- OSFI — Guideline E-23, Model Risk Management (2027)
- Federal Reserve — SR 26-2, Revised Guidance on Model Risk Management (17 April 2026)
New answers are posted on MINERVA on LinkedIn. Follow along, or send the question you’d like answered next to minerva@minerva.studio.
A plain-language explanation, not legal advice. The regulator’s own text is the source; read it, and take advice on how it applies to your institution.