Model Risk Directory emblemModel Risk Directory
Core ConceptsVendor modelExternal model

Third-party model

A model, score, parameter, data product, or analytical component obtained from an external provider. The institution remains responsible for due diligence, intended use, limitations, validation, monitoring, change, access, continuity, and exit.

Last updated: Last reviewed by: Model Risk Directory editorial team

How the term is used in model risk management

A model, score, parameter, data product, or analytical component obtained from an external provider. The institution remains responsible for due diligence, intended use, limitations, validation, monitoring, change, access, continuity, and exit. The exact implementation varies by institution, model type, risk rating, and governing framework. Use the linked regulatory pages and buyer guides below for scope-specific requirements.

Related glossary terms

Model inventoryModel validationModel limitations and assumptions

Guides and frameworks that use this term

GuideModel Risk ManagementModel risk management (MRM) is the discipline of identifying, measuring, and controlling the risk that a bank's quantitative models produce incorrect or misused results. An MRM advisory firm helps build or run that discipline: model inventory, tiering, governance, and independent validation, rooted in Federal Reserve SR 26-2 (formerly SR 11-7) and OCC guidance.GuideBest model risk management softwareThe best MRM software is the platform that fits your model inventory, governance workflow, evidence requirements, validation process, integrations, security controls, and operating model. This guide summarizes the directory's software vendors alphabetically. It does not award a winner without a shared test environment, verified pricing, and comparable customer evidence.GuideTop model risk management firmsThe right model risk management firm depends on the models in scope, governing framework, independence requirements, technical methods, jurisdiction, and delivery capacity. This guide groups the directory's advisory firms alphabetically and provides a verification checklist. It does not assign rankings, scores, or endorsements without comparable evidence.GuideModel Risk Management FrameworkA model risk management framework is the documented set of policies, roles, and processes an institution uses to identify, tier, govern, and validate its models. Under SR 26-2, a sound framework covers model development and use, independent validation, and governance and controls, scaled to the institution's size and model risk profile rather than applied uniformly.GuideOCC Model Risk ManagementOCC-supervised national banks and federal savings associations are now governed by OCC Bulletin 2026-13, 'Model Risk Management: Revised Guidance,' issued jointly with the Federal Reserve and FDIC on April 17, 2026. It replaced the long-standing OCC Bulletin 2011-12, shifting to a risk-based approach while keeping the same foundational model development, validation, and governance disciplines.GuideModel Risk Management SoftwareModel risk management software centralizes a bank's model inventory, tracks validation status and lifecycle events, and automates governance workflows like tiering, revalidation scheduling, and audit-trail documentation. It replaces manual spreadsheet tracking, which becomes unmanageable once an institution has more than a handful of tiered models.