Model Risk Directory emblemModel Risk Directory
Core ConceptsMRM

Model risk management

The discipline of identifying, measuring, and controlling model risk across an institution's full model inventory, encompassing model development and use, independent validation, and governance, policies, and controls. Rooted in SR 11-7 (2011) and now SR 26-2 (2026) in the US.

Last updated: Last reviewed by: Model Risk Directory editorial team

How the term is used in model risk management

The discipline of identifying, measuring, and controlling model risk across an institution's full model inventory, encompassing model development and use, independent validation, and governance, policies, and controls. Rooted in SR 11-7 (2011) and now SR 26-2 (2026) in the US. The exact implementation varies by institution, model type, risk rating, and governing framework. Use the linked regulatory pages and buyer guides below for scope-specific requirements.

Related glossary terms

Model riskModel validationModel governance

Guides and frameworks that use this term

GuideModel Risk ManagementModel risk management (MRM) is the discipline of identifying, measuring, and controlling the risk that a bank's quantitative models produce incorrect or misused results. An MRM advisory firm helps build or run that discipline: model inventory, tiering, governance, and independent validation, rooted in Federal Reserve SR 26-2 (formerly SR 11-7) and OCC guidance.GuideModel Risk Management FrameworkA model risk management framework is the documented set of policies, roles, and processes an institution uses to identify, tier, govern, and validate its models. Under SR 26-2, a sound framework covers model development and use, independent validation, and governance and controls, scaled to the institution's size and model risk profile rather than applied uniformly.GuideTop model risk management firmsThe right model risk management firm depends on the models in scope, governing framework, independence requirements, technical methods, jurisdiction, and delivery capacity. This guide groups the directory's advisory firms alphabetically and provides a verification checklist. It does not assign rankings, scores, or endorsements without comparable evidence.GuideBest model risk management softwareThe best MRM software is the platform that fits your model inventory, governance workflow, evidence requirements, validation process, integrations, security controls, and operating model. This guide summarizes the directory's software vendors alphabetically. It does not award a winner without a shared test environment, verified pricing, and comparable customer evidence.GuideModel Risk ValidationModel risk validation is the independent testing of a specific model's conceptual soundness, ongoing performance, and outcomes, performed by staff or a third-party firm genuinely separate from that model's development. It is the 'effective challenge' function required under SR 26-2 and SR 11-7, distinct from broader model risk management program design.GuideOCC Model Risk ManagementOCC-supervised national banks and federal savings associations are now governed by OCC Bulletin 2026-13, 'Model Risk Management: Revised Guidance,' issued jointly with the Federal Reserve and FDIC on April 17, 2026. It replaced the long-standing OCC Bulletin 2011-12, shifting to a risk-based approach while keeping the same foundational model development, validation, and governance disciplines.