Model Risk Management
Find the right advisory firm to build or run your model risk management program.
Model risk management (MRM) is the discipline of identifying, measuring, and controlling the risk that a bank's quantitative models produce incorrect or misused results. An MRM advisory firm helps build or run that discipline: model inventory, tiering, governance, and independent validation, rooted in Federal Reserve SR 26-2 (formerly SR 11-7) and OCC guidance.
Real US search demand (Ahrefs): ~1,000 searches/mo for "model risk management" · ~$0.45 CPC.
The buyer problem
Banks, credit unions, and insurers running quantitative models for credit, market, pricing, or capital decisions need a defensible model risk management program under SR 26-2 (the current interagency guidance that replaced SR 11-7 in April 2026) and OCC Bulletin 2026-13. Many institutions, especially those under $30 billion in assets that never had to build a large in-house MRM function, do not have the specialized quantitative and regulatory expertise on staff to design an inventory, tiering methodology, validation cadence, and governance structure that will hold up to an examiner. Retaining an outside MRM advisory firm is the standard path, but the market ranges from Big 4-scale practices to boutique quant shops, and buyers rarely know how to compare them on substance rather than brand name.
What a model risk management engagement covers
An MRM advisory engagement typically starts with a current-state assessment: what models exist, whether they are inventoried and tiered, whether validation has kept pace, and where governance gaps sit relative to SR 26-2's three pillars (development/use, independent validation, governance/controls). From there, firms typically help design or refresh the model inventory and tiering methodology, draft or revise MRM policy and procedure documents, stand up or augment an independent validation function, and prepare management for exam readiness. Some firms also perform hands-on independent validation work themselves as an extension of the second line, distinct from a standalone validation-only engagement (see the separate model risk validation guide for that narrower service).
Methods and techniques
- Current-state MRM gap assessment against SR 26-2/OCC 2026-13
- Model inventory design and tiering methodology
- MRM policy, procedure, and governance-charter drafting
- Independent validation function design and staffing support
- Exam readiness preparation and mock exam walkthroughs
- Vendor and third-party model oversight process design
What to verify before you retain
- Regulatory grounding. Confirm the firm's methodology and templates are updated for SR 26-2, not still built around the superseded SR 11-7 framework, since the interagency guidance changed materially in April 2026.
- Quantitative bench strength. Ask who specifically will staff the engagement and their background: model risk requires real quantitative and regulatory experience, not generalist risk consulting.
- Independence from validation. If the same firm will later validate the models it helped design governance for, confirm how they preserve independence, or plan to use a separate validator.
- Institution-size fit. A methodology built for a $200B bank may be badly oversized for a $5B community bank; ask for examples of engagements at your asset-size tier.
- Deliverable specificity. Get a concrete list of what documents and artifacts you will have at the end: inventory template, tiering methodology, policy drafts, not just 'recommendations.'
Questions to put in your RFP
- How has your MRM methodology changed to reflect SR 26-2's April 2026 revisions, specifically the shift to risk-based revalidation cadence?
- Can you share (anonymized) examples of MRM programs you've built for institutions our size?
- Who on your team will actually staff this engagement, and what is their MRM-specific background?
- How do you handle vendor and third-party models in the inventory and tiering approach?
- What is your approach to keeping model governance proportionate rather than over-engineered for our asset size?
- Do you offer independent validation as a follow-on service, and if so, how do you preserve independence from any advisory work you did first?
Skip the cold search. Send this scope to us and we route it toward qualified model risk management firms.
Request firmsRed flags
- A firm still pitching SR 11-7 by name as the current standard with no mention of SR 26-2.
- A one-size-fits-all MRM framework with no evidence of tailoring to institution size or complexity.
- Vague staffing promises without named team members or their quantitative credentials.
- No willingness to discuss how they'd preserve independence if also asked to validate models later.
- Pressure to sign a multi-year retainer before a scoped current-state assessment.
Frameworks referenced
Named regulatory guidance relevant to this category. Listed for context; they do not endorse this index or any vendor. Verify any framework alignment claim directly against the issuing body.
- SR 26-2
- SR 26-2 / OCC Bulletin 2026-13: Revised Guidance on Model Risk Management. SR 26-2 (issued by the Federal Reserve as a Supervisory Letter, and simultaneously as OCC Bulletin 2026-13 and an FDIC Financial Institution Letter) reflects fifteen years of supervisory experience since SR 11-7 and updates model risk management expectations for a risk-based, tailored era. It is expected to be most relevant to banking organizations with over $30 billion in total assets. The guidance retains the three foundational pillars, model development and use, validation and ongoing monitoring, and governance and controls, while replacing SR 11-7's de facto annual review cycle with revalidation frequency tied to model materiality, change velocity, and data availability, and expanding attention to vendor and third-party models. Read more →
- SR 11-7
- SR 11-7: Guidance on Model Risk Management. Issued April 4, 2011 jointly with the OCC (as Bulletin 2011-12), SR 11-7 set out supervisory expectations for how banks should manage the risk that quantitative models produce incorrect or misused results. It organized model risk management around three pillars: model development, implementation, and use; model validation; and governance, policies, and controls, and introduced 'effective challenge' as the guiding principle for meaningful independent review. Read more →
- OCC 2011-12
- OCC Bulletin 2011-12: Sound Practices for Model Risk Management. OCC Bulletin 2011-12, 'Supervisory Guidance on Model Risk Management,' articulated the elements of a sound program for managing risk from quantitative models used in bank decision-making. Its text was substantively identical to the Federal Reserve's SR 11-7, reflecting that both agencies developed the guidance jointly, and it applied to national banks and federal savings associations supervised by the OCC. Read more →
Notable model risk management vendors
Real, publicly-documented vendors active in this category. Sourced and verified; not a ranking or endorsement.
Model Risk Management: buyer FAQ
Is model risk management the same as AI governance?
No. Model risk management is a financial-regulatory discipline rooted in SR 11-7 (2011) and now SR 26-2 (2026), focused on quantitative/statistical models for credit, market, pricing, and capital decisions at banks and insurers. AI/LLM governance is a related but distinct field. Some large firms serve both, but verify their model risk management-specific service line separately.
Do we need an outside firm, or can we build MRM in-house?
Larger institutions with dedicated quant teams often build MRM in-house and use outside firms selectively for independent validation or peak-period capacity. Smaller institutions without that bench strength typically need an outside advisory firm for program design and, per SR 26-2's effective-challenge principle, an independent party for validation.
How long does an MRM program build typically take?
A current-state assessment and gap report usually takes 4-8 weeks. Building or overhauling the full inventory, tiering methodology, policy set, and validation function is typically a multi-month to multi-quarter engagement depending on model count and institution complexity.