MODEL RISK MANAGEMENT (MRM)

Models increasingly shape decisions that directly affect financial performance, capital, risk exposures, and trust in banks. Yet every model, regardless of its sophistication, carries risk.

Banks rely on quantitative models, algorithms, and artificial intelligence (AI) systems across virtually all key areas of their operations – from credit decision-making and expected credit loss estimation to capital and liquidity planning, fraud detection, customer management, and business process automation.

The development of machine learning (ML), generative artificial intelligence (GenAI), and the growing use of externally developed models are further transforming the nature of risks faced by banks.

A model may be methodologically inadequate, based on poor-quality data, incorrectly implemented, used outside its intended purpose, or insufficiently transparent. The consequences may include poor business decisions, financial losses, regulatory deficiencies, and reputational risks.

Model Risk Management (MRM) is a structured framework of governance, responsibilities, methodologies, and controls designed to ensure that models are developed, acquired, validated, used, monitored, and retired in a controlled manner.

RISKA provides specialized advisory and training services to banks in establishing and enhancing MRM frameworks, including the management of AI models, AI-related risks, and outsourcing risks.

How Can We Support Your Bank?

Development and Enhancement of MRM Frameworks

Support in establishing and enhancing a comprehensive model risk management framework tailored to the bank’s size, complexity, business model, and risk profile.

Our services include:

• Development and review of model risk management policies.

• Definition of methodologies for identifying, assessing, and classifying model risk.

• Establishment of model materiality and criticality criteria.

• Definition of responsibilities for model owners, users, development teams, and independent control functions.

• Establishment of model approval, validation governance, monitoring, and change management processes.

• Integration of the MRM framework into the internal control system and the three lines of defense.

The objective is to establish a framework that enables the bank to understand which models it uses, how important they are, what risks they introduce, and who is responsible for managing those risks.

Model Inventory and Lifecycle Management

A comprehensive and up-to-date model inventory is a fundamental component of an effective MRM framework.

RISKA supports the establishment and enhancement of model inventories, including:

• Identification of traditional, statistical, AI/ML, and externally developed models.

• Documentation of model purpose, methodology, data, and areas of application.

• Classification according to risk, materiality, and business criticality.

• Definition of model ownership and responsibilities.

• Recording of validation status, limitations, and findings.

• Management of model versions, changes, and retirement.

Particular attention is given to models embedded in external software solutions, where the bank may not have full visibility into the underlying methodology or source code.

AI MODELS AND AI RISK MANAGEMENT

Artificial Intelligence Risk Management

The adoption of artificial intelligence creates new opportunities, but also introduces new sources of risk that require appropriate governance and control mechanisms.

Traditional MRM principles remain relevant but must be adapted to the specific characteristics of AI/ML systems, including their complexity, evolving behavior, dependence on data, and the limited explainability of certain models.

RISKA supports banks in developing approaches to AI risk management through:

• Identification and classification of AI systems according to purpose, significance, and risk level.

• Assessment of data quality, origin, and representativeness.

• Analysis of bias and the risk of discriminatory outcomes.

• Assessment of model transparency, interpretability, and explainability.

• Establishment of appropriate human oversight.

• Definition of controls for monitoring performance, deviations, and changes in model behavior.

• Management of risks associated with automated decision-making.

• Documentation of AI systems, their limitations, and related responsibilities.

Particular emphasis is placed on integrating AI risks into the bank’s existing risk management framework rather than treating them as an entirely separate technological discipline.

Generative Artificial Intelligence (GenAI) and Emerging Model Risks

The growing adoption of large language models (LLMs) and generative artificial intelligence raises additional concerns regarding reliability, data protection, and control over model outputs.

RISKA provides advisory support in identifying and assessing risks associated with:

• Inaccurate or fabricated outputs (hallucinations).

• Limited explainability and difficulties in verifying generated information.

• Inappropriate use of confidential and sensitive data.

• Bias and inconsistent responses.

• Dependence on external AI platforms and service providers.

• Inappropriate reliance on AI-generated outputs in business and credit decisions.

• Insufficiently defined responsibilities and human oversight.

The key question is not only how accurate an AI model is, but also how well the bank understands its limitations, controls its use, and can explain decisions based on its outputs.

AI Governance – Accountability, Oversight, and Control

Effective AI governance requires clearly defined organizational structures and responsibilities.

RISKA supports banks in integrating AI Governance principles into their existing MRM frameworks, including:

• Defining the responsibilities of senior management and relevant governing bodies.

• Clarifying the roles of business units, IT, risk management, compliance, and internal audit.

• Establishing AI system approval and oversight procedures.

• Defining acceptable and unacceptable uses of AI.

• Integrating AI risks into existing risk assessment and reporting processes.

• Developing internal competencies for the responsible use of AI technologies.

EXTERNALLY DEVELOPED MODELS AND OUTSOURCING RISKS

Managing Risks Associated with Externally Developed Models

Banks increasingly rely on externally developed models and algorithmic solutions, including commercial software platforms, credit scoring systems, analytical tools, and AI services.

Although such solutions can accelerate digital transformation and improve business processes, they do not relieve banks of responsibility for managing the risks associated with their use.

An externally developed model does not mean outsourced accountability.

RISKA supports banks in:

• Identifying and classifying externally developed models.

• Assessing risks before procurement and implementation.

• Evaluating the availability of methodological and technical documentation.

• Assessing the feasibility of independent validation and ongoing performance monitoring.

• Defining responsibilities between the bank and its vendors.

• Managing changes introduced by external service providers.

• Assessing vendor dependency and concentration risks.

• Developing controls for the continuous oversight of external models.

Outsourcing, Vendors, and Third-Party AI Services

Where the use of external models involves outsourcing business processes or services, MRM should be integrated with the bank’s outsourcing and third-party risk management framework.

Our support may include:

• Assessing the criticality and significance of outsourced activities.

• Analyzing risks associated with vendors and subcontractors.

• Reviewing contractual rights to information, audit, and access to documentation.

• Defining requirements for security, confidentiality, and data protection.

• Establishing mechanisms for monitoring service performance and quality.

• Assessing business continuity and service disruption risks.

• Developing exit strategies and vendor replacement plans.

• Integrating outsourcing risk with operational risk, ICT risk, and model risk.

MRM ACROSS KEY BANKING PROCESSES

Integrating Model Risk Management into Banking Operations

RISKA supports the application of MRM principles to models used in:

• Credit Risk: Credit scoring, rating models, probability of default estimation, and credit decision-making.

• IFRS 9: Expected credit loss models, including PD, LGD, EAD, and macroeconomic scenarios.

• ICAAP and ILAAP: Models used for internal capital and liquidity adequacy assessments.

• Stress Testing: Projection models, scenario analysis, and assessment of stress event impacts.

• Market and Liquidity Risk: Valuation, risk measurement, and forecasting models.

• Operational Risk and Fraud Prevention: Analytical and AI models used to identify unusual patterns.

• Business Planning: Forecasting, profitability, and strategic decision-support models.

Particular emphasis is placed on understanding how model assumptions, limitations, and errors may affect the bank’s balance sheet, income statement, capital position, and business decisions.

Why Does Model Risk Management Matter?

An effective MRM framework enables banks to:

• Gain a more comprehensive overview of the models and AI systems they use.

• Clearly define responsibilities and control mechanisms.

• Reduce the risk of poor decisions based on unreliable models.

• Strengthen governance over model validation and ongoing monitoring.

• Identify emerging risks associated with new AI technologies.

• Manage external models and vendor dependencies more effectively.

• Strengthen regulatory compliance and preparedness for supervisory reviews.

• Increase the transparency and reliability of model outputs.

• Support safer and more responsible digital transformation.

Effective model risk management is not a barrier to innovation. It creates the conditions for banks to use advanced analytics and artificial intelligence while understanding and controlling the associated risks.

 

RISKA ONLINE PROGRAM: MODEL RISK MANAGEMENT (MRM)

Understand the Risks of Traditional and AI Models. Develop the Skills to Manage Them Responsibly.

The Model Risk Management (MRM) online training program is now available on the RISKA online learning platform in local language.

The program is designed for banking professionals who want to understand regulatory expectations, establish effective MRM frameworks, and strengthen model governance and controls throughout the entire model lifecycle.

Special emphasis is placed on emerging challenges associated with AI/ML technologies and the practical application of model risk management principles in banking.

What Does the Online Program Cover?

• Regulatory approaches and expectations for model risk management.

• MRM Governance, responsibilities, and the three lines of defense.

• Model lifecycle management.

• Establishment and maintenance of model inventories.

• Model risk assessment and classification.

• Independent validation principles, monitoring, and change management.

• Specific risks associated with AI/ML models.

• Practical application of MRM principles in financial institutions.

 

Program at a Glance

9 Modules | 50 Lessons | Over 240 Minutes of Video Content

 

The online format allows participants to access the training and learn at their own pace.

Who Is the Program Designed For?

• Risk managers and risk management professionals.

• Model owners and employees responsible for model implementation and use.

• Model development and validation specialists.

• Internal audit and other control functions.

• IT, analytics, and digital transformation professionals.

• Professionals seeking to understand the risks associated with AI model applications in financial institutions.

Start Learning Online

Strengthen your model risk management knowledge and prepare for the challenges of data-driven and AI-enabled banking.

The program is available on the RISKA online learning platform, with online purchase options.

Institutions that prefer purchasing through a pro forma invoice or standard invoice may contact the RISKA team directly.

EXPLORE THE PROGRAM AND ENROLL →

RISKA Online Programs

RISKA PROFESSIONAL TRAINING AND IN-HOUSE PROGRAMS

Developing Competencies for Modern Model Risk Management and AI Risk Governance

In addition to the online program, RISKA develops and delivers professional training and practical workshops tailored to the needs of individual financial institutions.

Our training combines regulatory expectations, methodological approaches, governance responsibilities, and practical challenges associated with traditional and AI models.

Key Training Areas

• Regulatory and supervisory approaches to model risk management.

• MRM Governance and the three lines of defense.

• Model lifecycle management, inventories, and classification.

• Model risk assessment methodologies.

• Independent validation principles and ongoing monitoring.

• AI/ML models and their specific risks.

• Generative artificial intelligence and AI Governance.

• Externally developed models and outsourcing risks.

• Change management and vendor accountability.

• The impact of models on financial performance and management decision-making.

Training may combine expert presentations, practical examples, case studies, simulations, and discussions on challenges related to implementing MRM frameworks.

Who Are Our Advisory Services Designed For?

RISKA advisory services are designed for banks and other financial institutions, particularly:

• Risk management professionals and managers.

• Model owners and employees responsible for model implementation and use.

• Model development, validation, and monitoring teams.

• Credit analysts and IFRS 9 specialists.

• IT, data analytics, and digital transformation professionals.

• Compliance, operational risk, and outsourcing management functions.

• Internal audit and other control functions.

• Senior management and governing bodies responsible for risk oversight and technological innovation.

Advisory Support Tailored to Your Institution

There is no single MRM framework that fits every bank.

Model complexity, the degree of automation, the use of AI technologies, dependence on external vendors, and organizational capabilities vary across institutions.

That is why RISKA provides customized advisory and training services, tailored to each client’s business model, risk profile, and regulatory environment.

Our support may include:

• Assessment of existing MRM framework maturity and gap analysis.

• Development of policies, methodologies, and procedures.

• Establishment of model inventories and classification frameworks.

• Enhancement of validation governance and monitoring processes.

• Integration of AI Governance principles.

• Assessment of risks associated with external models and vendors.

• Development of employee and control function competencies.

Models Can Support Decisions. Accountability Remains with the Institution.

Reliable models, responsible use of artificial intelligence, and effective outsourcing risk management are essential foundations of modern banking.

RISKA helps banks establish and enhance model risk management frameworks that connect regulatory expectations, governance accountability, and practical business needs.

Contact us to discuss advisory support, an assessment of your existing MRM framework, or professional training tailored to your institution.

contact@riska.ba

Looking to strengthen your MRM competencies at your own pace?

Explore RISKA Online Programs