Model risk: know what the numbers can support

Read the original article by Praful Mainker, published with permission from Endurance Advisory Partners. This edition uses plain language.

A model uses data and a method to produce an estimate. Banks may use models to assess losses, cash needs, credit risk or other questions. A useful result still has limits.

Model risk is the risk of harm from a model that is wrong or used in the wrong way. A spreadsheet can carry high risk if a major decision depends on it. Simple calculations are outside the model definition in SR 26-2. A tool can still need controls even when it is not a model under that guidance. A complex tool may carry less risk if it only points to cases for review.

The current SR 26-2 guidance replaced SR 11-7 in April 2026. It stresses an approach based on model use and risk. It is supervisory guidance, not an enforceable standard. It is most relevant above $30 billion in banking assets and may also be relevant to some smaller banks with significant model risk. The guidance excludes generative and agentic AI from its scope. That does not remove the need for sound controls over those tools.

Start with the use

What decision will the model support? Who will use it? What could go wrong if it fails? These questions help set the depth of review. Keep a record of the models in use, their owners and their known limits.

Review the inputs, the method and the output. A result can look precise even when its data is weak. A model can also be used for a task it was not built to support.

Learn from past failures

Past financial crises show the cost of weak assumptions. A model may work in normal times but fail in stress. Credit losses, rate changes and sudden market shifts can exceed what its design allowed.

The same lesson applies to smaller banks. Test lending, cash-flow and growth plans against adverse conditions. Check whether local facts or changes in customer behavior make past data less useful.

Test the model and its limits

Check whether the model does what its stated use requires. Review should have enough independence from the work being tested. Development checks alone do not provide that independent view.

Test key assumptions and a range of conditions. Check intermediate results where possible. Review changes to the model, its data and its use. Plan further review based on the risk.

A vendor’s model also needs review. Ask what can be tested, what is hidden and how the vendor handles faults. Record gaps in the proof and decide how they affect use.

Plan for change

Decide what would trigger more review or a pause in use. Who can stop the model? Is there a backup process? What should staff do if the model no longer gives a useful result?

Check the data as well as the method. Missing fields, poor matches and old records can weaken results. A match from an outside data source may still need more proof.

AI adds its own risks. Training on past human labels can repeat their blind spots. A method that looks beyond those labels may help find new patterns. It still needs tests, clear limits and a defined use.

Leaders and the board need a clear view of model risks. Reports should show key gaps, decisions and actions. The depth of detail should match what each group needs to do.

Can the team explain when the model should be trusted, when it should be challenged and when its use should stop?