AI glossary · Advanced · Safety & alignment · MLOps & LLMOps · Finance & insurance
Model risk management
Model risk management is a framework that manages the entire life of a model, from development, validation and approval to monitoring and retirement, to prevent losses that occur when the credit scoring, pricing and AI models used by financial companies are wrong or misused.
About this term
- Level
- Advanced · Specialist terms that need the inner workings
- Category
- Industry AI
- Fields
- Safety & alignment, MLOps & LLMOps
- Industries
- Finance & insurance
- Added
- 2026-10-10
How it works
First, all models in the company are tracked in a list (a model inventory) and rated by how much impact they have. A new model is approved only after a validation team independent of the development team examines its data, assumptions, performance and limitations. After deployment, it is monitored for performance drops and for data drift, where the nature of the input data changes, and it is revalidated regularly. Models that no longer fit are fixed or retired. This is often run as a "three lines of defense" structure, where the development and user departments, the independent validation and risk management departments, and internal audit each take a separate role.
Model lifecycle management
Model inventory and rating
- 1Development
- 2Independent validation
- 3Approval and deployment
- 4Monitoring
- 5Revalidation, fixes, retirement
- 1. Development Document data and assumptions
- 2. Independent validation Checked by a team separate from development
- 4. Monitoring Performance drops and data drift
Why it matters
Financial companies rely heavily on models for loan approvals, insurance pricing, derivative pricing and even regulatory capital calculations. If a model rests on wrong assumptions or is used for something other than its original purpose, it can lead to large losses or unfair decisions. For this reason, financial regulators treat model risk management as a basic obligation of financial companies, and the SR 11-7 guidance from US regulators is often cited as the main standard. As AI and machine learning models grow in number, the scope of what must be managed is widening.
Good to know
Existing frameworks were built with statistical models in mind, so they are hard to apply as-is to generative AI such as LLMs. An LLM can give different answers to the same question, its reasoning is hard to explain, and since it is often a third-party vendor's model, its training data and internal structure are often hard to check directly. So approaches are being discussed that bring prompts and retrieved documents into the scope of validation and combine hallucination and bias checks, Evals and human review. For regulatory compliance, it is also important to keep records of which data a model used to make which decisions.
What else to check when managing LLMs
Model characteristics
- Does it give consistent answers to the same question?
- Can its reasoning be explained?
- Has information on the third-party model been obtained?
Validation scope
- Have prompts and retrieved documents also been validated?
- Have hallucination and bias been checked?
- Are Evals and human review in place?
- Are decision records kept?
Example
Suppose a bank introduces a new credit scoring model. Once the development team builds the model, an independent validation team tests whether the training data is biased and whether the model holds up in situations such as a recession, and the model is deployed after committee approval. After deployment, the bank monitors whether its default rate predictions drift from actual results, and starts revalidation if the gap grows. When the same bank introduces an LLM chatbot for customer service, it also checks answer quality and risks within this framework.