Model risk management that watches every model monthly, re-scopes the inventory to SR 26-2 and drafts the validation
Drift caught the month it starts, not at next year's validation.
See one case, screen by screen ↓Software that keeps a bank’s model inventory, tiers each model by materiality, plans and records independent validation, monitors models in production and tracks findings to closure. Model Risk Management adds agents that score every model monthly on production data, re-scope the inventory, read the evidence and draft the validation report — people decide and sign.
How to choose AI solutions for lending →
Updated
A bank runs hundreds of models — probability of default and loss given default, the CECL allowance, stress loss projection, deposit beta, prepayment, fraud and customer risk rating — and each one is validated on a calendar. Between validations, quarterly monitoring reports get read, but a model can lose its edge in one segment for a year while the portfolio total still looks calibrated.
Now the rulebook has changed under a live inventory. SR 26-2 replaced SR 11-7 in April 2026: it narrows what counts as a model, ties validation timing to materiality instead of a default annual cycle, and leaves generative and agentic AI for each bank to govern itself. Every entry built under the 2011 guidance needs a scope decision and a tier that internal audit can test — and the plan on the old cycles already needs 34,600 validator hours from a team that has 22,400.
Estimated split for a Tier 1 credit model’s annual validation, by hand and with the solution.
Seven specialist agents watch every model on production data, open revalidation when one drifts, and draft the validation; the Head of Model Risk Management and a validator decide and sign.
Northmere Bancorp, $41.3 billion in assets, 412 inventory entries, the Model Risk Committee in eight days. Here is Monday 12 October, screen by screen, in the working solution.
The 06:00 run scored 183 models on September production data: 0 out of control, 2 trending, 182 in control. The CRE probability of default model, CRE-PD-v4, is trending — its rolling 12-month AUC at 0.796 against a centre of 0.820 and a lower control limit of 0.795. Then the September CRE defaults file arrives.
“September defaults arrived at 08:52 — 3,084 CRE loans to score. The line has been below centre for a year and falling every month since December.”
Elena presses “Score September’s defaults”. The new point lands at 0.788, below the lower control limit, and current loan-to-value PSI reaches 0.27 against a 0.25 limit. Revalidation task RV-2026-031 opens on its own: the trigger, the scope (office recalibration; construction-loan use), Owen Adeyemi assigned, joined to the annual validation due 30 October, four pieces of evidence attached.
“Accuracy fell below the lower control limit — AUC 0.788 against 0.795 in September, after a year below centre and nine months falling.”
September’s point shows where the drop comes from. By segment, office has fallen to an AUC of 0.68 from 0.80 at development, while multifamily, retail, industrial and hospitality hold. Office loans defaulted at twice the predicted rate: 16 defaults against 8.1 expected. The office back-test, the Q3 2026 monitoring report, the challenger results and change log CL-44 sit one click away.
The CRE model is not the only thing due before the committee. Elena starts the SR 26-2 re-scope: four agents test all 412 entries against the new definition of a model. 298 stay models, 86 move to the tools and calculations register, 28 move to the AI tool register, and 14 borderline spreadsheets come to her to decide. Re-tiered by materiality, the 12-month plan falls from 214 validations to 131 — from 34,600 hours to 22,320, inside the team’s 22,400.
“298 + 86 + 28 = 412 · nothing is deleted: every entry that leaves keeps its owner, history and reason, for internal audit to test.”
Each entry carries its scope test against SR 26-2 §II and its materiality against §III. For CRE-PD-v4: a complex quantitative method, statistical theory, quantitative estimates, not generative AI — so a model. Exposure of $11.8 billion and a financial-reporting purpose keep it in Tier 1.
“Logistic regression fitted to loan history — statistical theory turning inputs into default estimates, so a model.”
Owen’s validation starts from the evidence, not a blank template. The agents read the 146-page development document, four monitoring reports, the change log, the 2025 validation and the user guide; ran 23 of 23 tests; and drafted six report sections with 31 citations and four findings — one high, two medium, one low. The proposed rating is “Fit for use with conditions”, and the severity of each finding is the validator’s to change.
Across all CRE, 48 defaults on 3,084 loans — 1.56% observed against 1.34% predicted — sits inside the range. Office does not: 3.65% observed against 1.84% predicted, outside the 99% range, p = 0.008. The draft asks for a governed overlay of +181 bp until the office segment is recalibrated — about $13.7 million added to the CRE allowance.
“Overall the model looks calibrated; the office segment is not. A test on the total alone would have missed it.”
Elena approves the 2026 validation of CRE-PD-v4 as fit for use with conditions: the governed office overlay, no construction loans rated with the model until that use is validated, and the office segment recalibrated and re-validated by 18 January 2027. The signature records its meaning — “Approved as Head of Model Risk Management” — and Owen Adeyemi co-signs as lead validator.
The four new findings join the tracker with due dates set from the committee date by severity: High 18 January 2027, Medium 18 April 2027, Low 20 October 2027. Open findings rise from 63 to 67. Elena asks for reminders on the 7 overdue findings, the oldest 104 days late, and the tracker drafts the two extension requests for the committee.
The findings tracker never closes a finding — a validator does.
The pack closes Friday 16 October. Five agenda items, four decisions asked: ratify the 412 scope decisions and 298 tiers and adopt the 131-validation plan; approve CRE-PD-v4 with conditions; rule on 7 overdue findings and 2 extension requests; adopt the AI tool standard v1 with 4 control gaps to close in 30 days.
The same Monday, seen by the five people who carry it — the model owner, the validator, the Head of Model Risk Management, the CRO and internal audit.
Seven specialist agents watch every model on production data, open revalidation when one drifts, and draft the validation; the Head of Model Risk Management and a validator decide and sign.
Tests every inventory entry against the SR 26-2 definition of a model — a complex quantitative method applying statistical, economic or financial theory to produce estimates — and routes simple calculations and AI tools to their own registers.
Proposes a tier from exposure, purpose and inherent risk, and re-plans validation timing by tier.
Reads development and vendor documents, monitoring reports, change logs and prior findings, and maps each to a part of the validation.
Scores every model on production data each month, back-tests calibration, measures discrimination and stability, benchmarks a challenger and estimates the allowance effect on the bank’s own data.
Drafts each report section and the findings with citations, and proposes severity and the overall rating.
Tracks each finding’s owner, due date and remediation evidence; opens revalidation tasks on a breach; drafts reminders and extension requests.
Records each generative or agentic tool’s use, data, owner, the person who checks it and its controls.
Approves scope, tiers and validations; validator co-signs; committee ratifies. The agents propose; a named person decides.
The model risk team can ask about any model, test, finding or AI tool in plain words — or tell it what to chase. Answers cite their source.
Why does CRE-PD-v4 get a high finding?
Because the office segment fails its back-test. Over the four quarters to 30 June 2026, 16 of 438 office loans defaulted against 8.1 expected — 3.65% against 1.84% predicted, outside the 99% range (p = 0.008). Office AUC also fell to 0.68 from 0.80. Across all CRE the model looks fine, which is why a total-only test missed it. The draft asks for a governed +181 bp overlay until recalibration — about +$13.7M to the allowance.
Remind the owners of the 7 overdue findings
Done — seven reminders sent, each with what the validator needs to close the finding, from small-business override monitoring (Ana Ruiz, 104 days late) to the customer risk threshold (Tomas Reyes, 11 days). Kim Laszlo and Ben Ito asked for extensions last month, so both requests are drafted for the committee on 20 October.
Why did 86 entries leave the model inventory?
SR 26-2 narrows what a model is and excludes simple arithmetic in spreadsheets and deterministic rule-based processes. The 86 entries are calculators, fee and budget workbooks and fixed-threshold rules, such as the wire monitoring scenarios. They move to the tools register with their owner, history and reason, and are still attested once a year. Separately, 28 generative and agentic tools went to the AI tool register.
Which AI tools have a control gap?
Four of the 28: the data quality remediation agent writes to production without approval; the servicing call summary tool has no sample review against recordings; the loan modification intake agent’s actions are not logged to the servicing record; and the collections letter drafter has no person named to review letters before they are sent. The AI tool standard v1 sets the controls and goes to the committee on 20 October.
13 screens from the working solution, on its sample data. Pick one to see it large.
The agents apply the bank’s own policy. Changes are versioned and on the audit trail.
| Setting | Default | Choose from |
|---|---|---|
| Spreadsheets with forecasting logic | A person decides | A person decides · Keep as models · Treat as tools |
| Tier 1 exposure line | $1 billion | $500 million · $1 billion · $2 billion |
| Tier 1 validation | Every 12 months | Every 12 · 18 · 24 months |
| Control limits | ±3σ from the first 12 months in production | ±3σ · ±2.5σ · ±2σ |
| Control rules | 8 on one side · 6 moving | 8 on one side · 6 moving · 9 on one side · 6 moving · Limits only |
| When a limit is crossed (Tier 1 and 2) | Open a revalidation task | Open a revalidation task · Alert the owner only |
| Calibration test | Amber 95% · red 99% | Amber 95% · red 99% · Amber 90% · red 95% · Red 99% only |
| Finding due dates, from the committee date | High 90 · Medium 180 · Low 365 days | High 90 · Medium 180 · Low 365 days · High 60 · Medium 120 · Low 270 days |
Every figure is labelled: a target the solution is built to, an estimate, a typical published result, or a proven one.
“demo” = seen in the working solution, on its sample bank data · “target” = the design goal, measured in the live solution · “estimated” = our estimate of where a validation’s days go. Regulation: Federal Reserve, OCC and FDIC, SR 26-2 Supervisory Guidance on Model Risk Management (17 April 2026; replaces SR 11-7 and SR 21-8; generative and agentic AI outside its scope). People, banks and models named on this page are fictional — characters and sample data in the working solution.
Software that keeps a bank’s model inventory, tiers each model by materiality, plans and records independent validation, monitors models in production and tracks findings to closure. Model Risk Management adds agents that score every model monthly on production data, re-scope the inventory, read the evidence and draft the validation report — people decide and sign.
The inventory scoper tests every entry against the SR 26-2 definition of a model and cites the passage; the materiality tierer proposes a tier from exposure, purpose and inherent risk. Simple calculations move to a tools register and generative and agentic AI to an AI tool register, each with its reason. Borderline spreadsheets go to the Head of Model Risk Management, and the committee ratifies the result.
Each model gets a control chart for accuracy, stability and overrides, with a centre and ±3σ limits set from its first 12 months in production. The outcomes analyst scores it each month on production data; a control rule turns the model amber before a limit is crossed, and a breach on a Tier 1 or Tier 2 model opens a revalidation task with its evidence.
It drafts them. The validation drafter writes each section and the findings with citations and proposes severity and a rating; it never signs. The validator can change any severity, the Head of Model Risk Management signs as approver, and the lead validator co-signs.
SR 26-2 leaves them out of scope, so each tool goes into an AI tool register with its owner, what it does, whether it drafts, informs or acts, who checks its output, its controls and its review date. The AI tool registrar records them and flags control gaps; it never approves a tool for use.
Yes. Nothing is deleted: every entry keeps its owner, history and the reason for its scope and tier, with the passage it rests on. Internal audit has read-only access, and every agent step and human decision is on the audit trail.
Yes. The tier lines, validation timing by tier, control limits and rules, PSI, AUC and calibration thresholds, finding due dates and approvers are all settings. Changes are versioned and on the audit trail.
The Agentic Solution Engine builds and deploys it from your requirements — your model risk policy, your inventory, report template and a sample of past validations — and it goes live once every quality gate has passed. We will walk you through it on your own models first.
We’ll run Model Risk Management on a sample of your own inventory and monitoring data.