OCC Model Risk Management

The buyer problem

OCC-supervised institutions have spent over a decade building model risk programs around Bulletin 2011-12. As of April 17, 2026, that bulletin is rescinded, and OCC Bulletin 2026-13 is the current standard, issued jointly with the Fed's SR 26-2 and the FDIC. Institutions whose MRM policy documents, vendor contracts, and internal training still reference 2011-12 by name risk having an examiner flag stale documentation, even though the underlying program may substantively still be sound. Buyers need a firm that understands both what changed and what specifically OCC examiners will look for in the current exam cycle.

What a occ model risk management engagement covers

Firms working this specific angle help OCC-regulated institutions map their existing MRM program against Bulletin 2026-13's updated expectations: confirming the model definition and inventory scope match the revised guidance, updating validation cadence language from a calendar-driven to a risk-based approach, and refreshing policy documents and board materials to cite the current bulletin rather than the rescinded one. Some engagements include a mock exam or documentation walkthrough specifically framed around what an OCC examiner will ask under the new guidance.

Methods and techniques

• Gap assessment against OCC Bulletin 2026-13 specifically
• Policy and board-document citation refresh (2011-12 to 2026-13)
• Mock exam preparation focused on OCC examiner expectations
• Model inventory and definition-scope review against the revised guidance
• Vendor and third-party model documentation review

What to verify before you retain

• Firm cites Bulletin 2026-13, not just 2011-12. Any firm still pitching services purely around the rescinded Bulletin 2011-12 without acknowledging the April 2026 update has not kept current with OCC guidance.
• OCC-specific examiner experience. Ask whether the firm's staff have direct experience with OCC exams specifically, as opposed to Federal Reserve or FDIC exam experience only; expectations and exam style can differ by agency even under the same joint guidance.
• $30B asset-size context understood. Bulletin 2026-13 is explicitly framed as most relevant to institutions over $30 billion in assets; confirm the firm can right-size recommendations if you're below that threshold.
• Non-prescriptive framing is understood, not oversold. The 2026 guidance explicitly states it is not enforceable/prescriptive on its own; a firm implying otherwise, or treating every element as a hard mandate, may be overselling scope.

Questions to put in your RFP

1. What specifically changed in your methodology when Bulletin 2011-12 was replaced by 2026-13?
2. Have your consultants been through an actual OCC exam cycle under the new guidance, or only under the prior 2011-12 regime?
3. How would your recommendations differ for an institution under versus over the $30 billion asset threshold Bulletin 2026-13 references?
4. Can you help us refresh existing board materials and policy citations from 2011-12 to 2026-13?
5. How do you help us prepare for a mock exam walkthrough specific to OCC examiner practices?

Red flags

• Marketing materials or proposals that only reference OCC Bulletin 2011-12 with no mention of its April 2026 rescission.
• No OCC-specific examiner experience among proposed staff.
• Treating every element of Bulletin 2026-13 as a strict, enforceable mandate despite the guidance's own non-prescriptive framing.
• A generic 'we cover all interagency guidance' pitch with no OCC-specific detail when asked directly.

Frameworks referenced

Named regulatory guidance relevant to this category. Listed for context; they do not endorse this index or any vendor. Verify any framework alignment claim directly against the issuing body.

OCC 2011-12

OCC Bulletin 2011-12: Sound Practices for Model Risk Management. OCC Bulletin 2011-12, 'Supervisory Guidance on Model Risk Management,' articulated the elements of a sound program for managing risk from quantitative models used in bank decision-making. Its text was substantively identical to the Federal Reserve's SR 11-7, reflecting that both agencies developed the guidance jointly, and it applied to national banks and federal savings associations supervised by the OCC. Read more →

SR 26-2

SR 26-2 / OCC Bulletin 2026-13: Revised Guidance on Model Risk Management. SR 26-2 (issued by the Federal Reserve as a Supervisory Letter, and simultaneously as OCC Bulletin 2026-13 and an FDIC Financial Institution Letter) reflects fifteen years of supervisory experience since SR 11-7 and updates model risk management expectations for a risk-based, tailored era. It is expected to be most relevant to banking organizations with over $30 billion in total assets. The guidance retains the three foundational pillars, model development and use, validation and ongoing monitoring, and governance and controls, while replacing SR 11-7's de facto annual review cycle with revalidation frequency tied to model materiality, change velocity, and data availability, and expanding attention to vendor and third-party models. Read more →

SR 11-7

SR 11-7: Guidance on Model Risk Management. Issued April 4, 2011 jointly with the OCC (as Bulletin 2011-12), SR 11-7 set out supervisory expectations for how banks should manage the risk that quantitative models produce incorrect or misused results. It organized model risk management around three pillars: model development, implementation, and use; model validation; and governance, policies, and controls, and introduced 'effective challenge' as the guiding principle for meaningful independent review. Read more →