Financial services / Model governance / Evidence
Model risk support.Evidence that withstands review.
Model risk support connects a model’s purpose, assumptions, testing, validation, monitoring, and oversight to records that make continued reliance explainable. Use this page to scope a banking model-risk review, locate the evidence that matters, and preserve the reasoning behind a decision.
For model owners, validators, technology-risk professionals, AI governance teams, internal auditors, and business decision-makers working with quantitative models in financial services.
What the term means
Model risk begins with decisions made from model outputs.
A model can be mathematically sound and still create business risk when its assumptions are violated, its data changes, or its outputs are used for a purpose it was never evaluated to support.
Under SR 26-2, model risk concerns potential adverse financial consequences associated with models, including decisions based on their outputs. Its magnitude reflects inherent risk—such as assumptions, complexity, and data constraints—in the context of model exposure and purpose. [1]
The practical question for assurance is not whether a model has many documents. It is whether reviewers can reconstruct what the model was meant to do, what was tested, who challenged it, how its performance is observed, and what would cause its use to be restricted or revised.
The interagency document presents non-prescriptive supervisory principles, not standalone enforceable standards. An institution still needs to assess its applicable laws, safety-and-soundness obligations, internal policies, and model exposure. [2]
Regulatory applicability / 2026
Classify the system before applying the evidence map.
The April 2026 revision limits the model definition for this guidance. Organizational size, model materiality, and type of technology influence how the principles should inform a review. Do not interpret an exclusion from SR 26-2 as exemption from all governance obligations. [1] [2]
Complex quantitative models
Statistical, economic, or financial theories underpin a method that processes inputs into quantitative estimates. Start with the institution’s model classification and materiality assessment.
Non-generative, non-agentic AI models
The revised guidance states that its principles apply here. Evaluate the model and its use rather than treating the label “AI” as either sufficient or disqualifying.
Generative AI and agentic AI
Expressly excluded from SR 26-2. Route these systems through appropriate AI, technology, security, third-party, and business-risk governance instead.
Simple arithmetic and deterministic rules
Not covered by this model definition where statistical, economic, or financial theories do not underpin their design or use. Other controls may still be needed.
Applicability is not a hard $30 billion legal cutoff: the agencies say the guidance is expected to be most relevant above that size and may also be relevant to smaller organizations with significant model exposure. The FDIC likewise directs supervised institutions to tailor the review to their risk profile. [2] [5]
Model risk evidence crosswalk
Eight review areas. One reconstructable decision.
Read each row across: risk question → relevant records → assurance judgment. These are practical evidence prompts derived from the themes of SR 26-2—not prescribed documents, minimum tests, or a compliance score. [1]
- 01 / CLASSIFICATION
Identity and use
Why is this a model, and which business decisions actually rely on its output?
Inventory entry; purpose and intended use; process map; ownership; model boundaries and connected dependencies.
- 02 / RISK PROFILE
Inherent risk and materiality
Which assumptions, data constraints, complexity, exposure, and purpose warrant deeper review?
Assumptions; data-quality analysis; inherent-risk and exposure assessment; materiality rationale; aggregate dependencies.
- 03 / DEVELOPMENT
Design and testing
Do design choices and test conditions support the actual intended business use?
Methodology and input documentation; development tests; out-of-time/out-of-sample work where appropriate; exceptions.
- 04 / VALIDATION
Conceptual soundness
Have qualified reviewers critically assessed reliability, assumptions, theoretical support, limitations, and results?
Validation scope; reviewer challenge; comparative analysis; findings; responses; approval or limitation conditions.
- 05 / PERFORMANCE
Outcomes and monitoring
Do observed outcomes remain consistent with expectations, and what happens when results deteriorate?
Outcome analysis; back-testing where useful; thresholds; monitoring history; deviations; adjustment or redevelopment decisions.
- 06 / GOVERNANCE
Effective challenge
Who has the expertise, objectivity, and organizational influence to challenge the model and change its use?
Policies; responsibilities; independence considerations; challenge notes; escalation; accountable decision records.
- 07 / CONTINUITY
Inventory and documentation
Can another reviewer follow model versions, changes, issues, exceptions, and shared model dependencies?
Model inventory; documentation register; changes; remediation history; dependencies; unresolved recommendations.
- 08 / EXTERNAL RELIANCE
Vendor and customized models
What does the bank know and test when code or data are proprietary, and how are local adjustments evaluated?
Vendor evaluation; performance evidence; local validation and outcome analysis; customization rationale; monitoring and limitations.
Evidence file / Working structure
Build a model-risk evidence file from eight linked records.
These eight linked records connect the model, the underlying evidence, the challenge applied, and the decision. Adapt them to an existing model inventory, validation workflow, document repository, issue tracker, or GRC system.
Model profile
Identifier, classification, business owner, version, current use, users, approval boundary, dependencies, and inventory links.
Risk assessment
Inherent-risk factors, assumptions, exposure, purpose, materiality, data constraints, and justification for review depth.
Development record
Design choices, methodologies, input data, training or calibration periods, development testing, limitations, and accepted exceptions.
Validation record
Review scope, expertise, conceptual soundness, outcomes testing, independent challenge, findings, and management responses.
Monitoring record
Metrics, thresholds, frequency, data changes, outcome checks, alerts, overlays, performance trends, and follow-up actions.
Governance record
Decision authority, roles, review minutes, effective-challenge examples, conflicts, exceptions, and authorized use conditions.
Change and issue record
Version changes, use extensions, validation-impact decisions, findings, remediation, restrictions, waivers, and reassessment triggers.
Third-party record
Vendor claims and evidence, proprietary limitations, local tests, customizations, support arrangements, and retained gaps.
Minimum linkage to preserve
For each conclusion: model/use → claim or risk → evidence → reviewer challenge → decision/condition → owner → next review. This is the proposed traceability pattern, not a regulatory requirement.
Start small, scale by materiality
A lower-materiality model may use short records within existing systems. Higher-risk uses may require more extensive methodology documentation, validation work, monitoring, and governance evidence.
Monitoring / Review triggers
What should trigger a closer model review?
Useful monitoring connects a signal to a question and an accountable response. Choose measures based on the model, outcomes, data latency, and business consequence; do not apply one default threshold to every model. [1]
Record the metric and baseline, affected population and period, data quality checks, potential decision impact, review owner, evidence examined, approved disposition, next test and due date. Options may include additional investigation, a control overlay, limited use, recalibration, or redevelopment; the response depends on materiality and the evidence. [1]
The measures above are examples, not mandatory metrics or universal pass/fail cutoffs. The references distinguish supervisory model-risk principles from technical research on dataset shift and concept drift.
Worked review / Illustrative scenario
A model still runs. The evidence for relying on it has changed.
A bank uses a non-generative quantitative model to support lending decisions. A source-data change alters the distribution of incoming inputs. The model remains online, but its earlier tests may no longer describe current use. This scenario is illustrative, not a report of a specific bank.
- 01 / Signal
Monitoring finds a deviation.
Keep the dated alert, baseline definition, population affected, trend, threshold rationale, and recent data-pipeline changes. First determine whether the signal reflects a data issue, changed population, or model behavior.
- 02 / Challenge
Revisit what earlier testing supports.
Compare current inputs and observed outcomes with development and validation assumptions. Document where the original tests remain informative and where they no longer establish reliability.
- 03 / Decision
Set a bounded response.
The responsible owner considers additional testing, an overlay, temporary restriction, recalibration, or redevelopment as appropriate. Record who authorized the response and what information was considered.
- 04 / Closure
Verify the corrective action.
Preserve the updated evidence, challenge results, performance checks, residual limitations, authorization to continue or resume use, and the next reassessment trigger.
The earlier approval is not automatically invalid, and a monitoring breach does not automatically mandate one response. Changes in input distribution alone should not be treated as proof of reduced model quality. The useful record explains what changed, whether reliance remains justified, who decided, and what conditions now apply. This reflects the guidance’s risk-based treatment of monitoring and model adjustments and research distinguishing shifts from their consequences. [1] [8]
Adjacent AI governance
Exclusion from SR 26-2 is not exclusion from oversight.
Generative and agentic AI systems fall outside this particular interagency model-risk guidance. Their risks may require different evidence: task evaluations, retrieval quality, data flows, tool permissions, human authorization, harmful-output safeguards, monitoring, incident records, and change controls.
For those uses, NIST’s voluntary AI Risk Management Framework and Generative AI Profile are useful additional references, alongside the institution’s legal, security, privacy, operational, and third-party risk obligations. Neither NIST document changes the scope of SR 26-2. [3] [4]
Sources & evidence notesInteragency guidance, primary AI references, and peer-reviewed monitoring research
The crosswalk, evidence-file structure, monitoring reference, and case scenario are infoSecured.ai practitioner syntheses. Regulatory sources inform model-risk scope and governance; research sources inform measurement and interpretation. Neither source type prescribes these exact records or a universal alert threshold.
- [1]Federal Reserve Board / FDIC / OCC (April 17, 2026). Supervisory Guidance on Model Risk Management.Full interagency text: overview of model risk, model development/use, validation, outcomes, monitoring, governance, and vendor models. Footnote 3 addresses GenAI and agentic exclusions.
- [2]Office of the Comptroller of the Currency (April 17, 2026). OCC Bulletin 2026-13: Model Risk Management—Revised Guidance.Official summary of the interagency revision, risk-based tailoring, expected institution-size relevance, rescissions, exclusions, and non-prescriptive status.
- [3]National Institute of Standards and Technology (2023). Artificial Intelligence Risk Management Framework (AI RMF 1.0).Voluntary cross-sector AI risk-management framework for GOVERN, MAP, MEASURE, and MANAGE functions.
- [4]National Institute of Standards and Technology (2024). NIST AI 600-1: Generative Artificial Intelligence Profile.Companion guidance for generative-AI-specific risks. Not an extension of SR 26-2’s scope.
- [5]Federal Deposit Insurance Corporation (April 17, 2026). FIL-15-2026: Agencies Revise the Interagency Model Risk Management Guidance.Explains applicability for FDIC-supervised institutions, relevance of significant model exposure, and the guidance’s risk-based, non-prescriptive approach.
- [6]Federal Reserve Board / FDIC / OCC (June 6, 2023). Interagency Guidance on Third-Party Relationships: Risk Management (SR 23-4).Useful adjacent source for vendor oversight, lifecycle monitoring, documentation rights, controls, contingency, and incident coordination. A replacement was proposed in September 2026; see [9] for status. Do not treat the proposal as final.
- [7]Gama, J., Žliobaitė, I., Bifet, A., Pechenizkiy, M., & Bouchachia, A. (2014). A Survey on Concept Drift Adaptation. ACM Computing Surveys, 46(4), Article 44.Peer-reviewed distinction between changed input-to-target relationships and approaches for evaluating models under concept drift.
- [8]Rabanser, S., Günnemann, S., & Lipton, Z. (2019). Failing Loudly: An Empirical Study of Methods for Detecting Dataset Shift. NeurIPS 32.Empirical research on methods for detecting and characterizing distribution shifts; shift detection needs further analysis to determine business or model-performance harm.
- [9]Office of the Comptroller of the Currency (September 11, 2026). Third-Party Risk Management: Proposed Guidance and Request for Comment.Proposed replacement for existing interagency third-party guidance, included to clarify current-versus-proposed status; not presented as operative final guidance.