Model Risk Directory emblemModel Risk Directory
Core Concepts

Residual model risk

The model risk remaining after validation, controls, monitoring, limitations, overlays, restrictions, conservatism, and other mitigants are applied. Management decides whether the residual risk is acceptable within risk appetite.

Last updated: Last reviewed by: Model Risk Directory editorial team

How the term is used in model risk management

The model risk remaining after validation, controls, monitoring, limitations, overlays, restrictions, conservatism, and other mitigants are applied. Management decides whether the residual risk is acceptable within risk appetite. The exact implementation varies by institution, model type, risk rating, and governing framework. Use the linked regulatory pages and buyer guides below for scope-specific requirements.

Related glossary terms

Model risk appetiteModel risk ratingModel limitations and assumptions

Guides and frameworks that use this term

GuideModel Risk Management FrameworkA model risk management framework is the documented set of policies, roles, and processes an institution uses to identify, tier, govern, and validate its models. Under SR 26-2, a sound framework covers model development and use, independent validation, and governance and controls, scaled to the institution's size and model risk profile rather than applied uniformly.FrameworkOSFI E-23OSFI E-23 is Canada's enterprise-wide model risk management guideline for federally regulated financial institutions. The final 2025 guideline takes effect on 1 May 2027 and applies a risk-based approach across model identification, inventory, risk ratings, lifecycle governance, independent review, monitoring, third-party models, and decommissioning.