Guide

Model risk management: SR 11-7 basics

Banks and financial firms run on models: pricing engines, credit scorecards, stress tests, and capital calculations. When a model is wrong, the loss is real and often large. SR 11-7 is the supervisory guidance that frames how firms should manage that exposure. It treats every model as a potential source of risk and asks you to manage it deliberately, from the moment a model is built to the day it is retired.

What counts as a model

SR 11-7 defines a model broadly as a quantitative method that applies statistical, economic, or mathematical techniques to turn input data into estimates. That definition sweeps in spreadsheets, vendor tools, and machine learning systems alike. The first practical step is a complete inventory. You cannot govern what you have not listed, so each model needs an owner, a purpose, a risk rating, and a record of where its outputs are used.

Development, validation, and governance

Model risk management rests on three pillars. Sound development means clear documentation, tested assumptions, and data you can trace. Independent validation means someone other than the developer challenges the design, checks the math, and runs the model against real outcomes. Effective challenge is the heart of the guidance: a qualified reviewer with the standing to say a model is not fit for use. Governance ties it together through policies, defined roles, and a board that sees aggregate model risk. Ongoing monitoring catches drift as markets and portfolios change.

Track it in one place

Managing model risk usually means chasing inventories, validation dates, and findings across scattered files. A single-file dashboard from The Protocol Collective maps your models, owners, risk ratings, validation cycles, and open issues to the public SR 11-7 structure. You own it outright, paid once and updated for life. It is built from public frameworks, so you can see exactly how each control traces back to the guidance.

Explore The Protocol Collective

General information about compliance and program structure, not regulatory, legal, tax or financial advice, and no promise of any examination or audit outcome. Built from public frameworks.