Model Risk Directory emblemModel Risk Directory
GovernanceModel exception

Exception management

The controlled process for approving, documenting, limiting, monitoring, escalating, and closing deviations from model policy or normal governance requirements. Exceptions should have an owner, rationale, compensating controls, and expiry or review date.

Last updated: Last reviewed by: Model Risk Directory editorial team

How the term is used in model risk management

The controlled process for approving, documenting, limiting, monitoring, escalating, and closing deviations from model policy or normal governance requirements. Exceptions should have an owner, rationale, compensating controls, and expiry or review date. The exact implementation varies by institution, model type, risk rating, and governing framework. Use the linked regulatory pages and buyer guides below for scope-specific requirements.

Related glossary terms

Model risk appetiteValidation findingModel approval

Guides and frameworks that use this term

GuideModel Risk Management FrameworkA model risk management framework is the documented set of policies, roles, and processes an institution uses to identify, tier, govern, and validate its models. Under SR 26-2, a sound framework covers model development and use, independent validation, and governance and controls, scaled to the institution's size and model risk profile rather than applied uniformly.GuideModel Risk Management SoftwareModel risk management software centralizes a bank's model inventory, tracks validation status and lifecycle events, and automates governance workflows like tiering, revalidation scheduling, and audit-trail documentation. It replaces manual spreadsheet tracking, which becomes unmanageable once an institution has more than a handful of tiered models.FrameworkSR 26-2SR 26-2, issued jointly by the Federal Reserve, OCC, and FDIC on April 17, 2026, is the current US interagency guidance on model risk management. It supersedes SR 11-7 (2011) and SR 21-8 (2021), preserving core disciplines like effective challenge and independent validation while shifting to a risk-based approach tailored to an institution's model risk profile, size, and complexity.FrameworkPRA SS1/23PRA SS1/23 is the Bank of England Prudential Regulation Authority's supervisory statement setting out five model risk management principles for UK banks with internal model approval for credit, market, or counterparty credit risk. It took effect May 17, 2024 and explicitly extends to risks from AI and machine learning modeling techniques.