Model Risk Directory emblemModel Risk Directory
GovernanceModel risk classification

Model risk rating

A categorical or scored assessment of a model's inherent risk based on factors such as impact, use, complexity, data, autonomy, customer effects, and regulatory exposure. It drives governance intensity.

Last updated: Last reviewed by: Model Risk Directory editorial team

How the term is used in model risk management

A categorical or scored assessment of a model's inherent risk based on factors such as impact, use, complexity, data, autonomy, customer effects, and regulatory exposure. It drives governance intensity. The exact implementation varies by institution, model type, risk rating, and governing framework. Use the linked regulatory pages and buyer guides below for scope-specific requirements.

Related glossary terms

Model tieringModel risk appetiteResidual model risk

Guides and frameworks that use this term

GuideModel Risk Management FrameworkA model risk management framework is the documented set of policies, roles, and processes an institution uses to identify, tier, govern, and validate its models. Under SR 26-2, a sound framework covers model development and use, independent validation, and governance and controls, scaled to the institution's size and model risk profile rather than applied uniformly.GuideModel Risk Management SoftwareModel risk management software centralizes a bank's model inventory, tracks validation status and lifecycle events, and automates governance workflows like tiering, revalidation scheduling, and audit-trail documentation. It replaces manual spreadsheet tracking, which becomes unmanageable once an institution has more than a handful of tiered models.GuideTop model risk management firmsThe right model risk management firm depends on the models in scope, governing framework, independence requirements, technical methods, jurisdiction, and delivery capacity. This guide groups the directory's advisory firms alphabetically and provides a verification checklist. It does not assign rankings, scores, or endorsements without comparable evidence.FrameworkOSFI E-23OSFI E-23 is Canada's enterprise-wide model risk management guideline for federally regulated financial institutions. The final 2025 guideline takes effect on 1 May 2027 and applies a risk-based approach across model identification, inventory, risk ratings, lifecycle governance, independent review, monitoring, third-party models, and decommissioning.FrameworkPRA SS1/23PRA SS1/23 is the Bank of England Prudential Regulation Authority's supervisory statement setting out five model risk management principles for UK banks with internal model approval for credit, market, or counterparty credit risk. It took effect May 17, 2024 and explicitly extends to risks from AI and machine learning modeling techniques.