What it means
Model risk management establishes governance for selecting, approving, using, changing, challenging, and retiring models according to their impact and uncertainty.
Why it matters
Models can create financial, safety, privacy, security, legal, and reputational consequences even when software functions exactly as designed.
Practical focus
- Define the scope, owners, acceptable risk, and required outcome for model risk management before choosing a tool or platform feature
- Implement model inventories, impact tiers, accountable owners, independent challenge, use restrictions, change approval, and retirement criteria through documented, reviewable configuration and change control
- Collect validation status, approved use, exceptions, monitoring results, incidents, overrides, and decommissioning evidence and compare the results with approved baselines, service objectives, and policy requirements
- Exercise a model being reused, changed, or expanded beyond the conditions and impact level originally approved as a planned test case, including detection, containment, rollback, escalation, and evidence retention
Common mistakes
- Treating model risk management as a one-time technical setting instead of an operating control with owners and review cycles
- Using default thresholds or broad exceptions without connecting them to business, privacy, security, and availability requirements
- Keeping evidence in disconnected tools so reviewers cannot reconstruct who changed what, why it changed, or whether it worked
- Testing only the normal path and discovering during an incident that a model being reused, changed, or expanded beyond the conditions and impact level originally approved was never rehearsed
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: