Model Risk Management Policy and Model Inventory

How to use this document

• Use it to set out how the organization identifies, classifies, validates, approves, monitors and retires the models it uses, including AI and machine learning models and vendor models. It includes the model inventory format and the materiality worksheet.
• Give it a clear owner: usually the risk function (second line), with data science and business units as owners of each model and internal audit as the third line.
• Before adopting it, the organization should decide which body approves the policy (board or delegated committee), whether it creates a dedicated model risk committee or assigns these duties to the risk committee, who performs independent validation (internal team or third party) and which criteria and thresholds it uses for materiality tiers.
• Complete the [COMPLETE] fields in sections 5 (materiality thresholds), 8 (validation frequencies) and 10 (monitoring thresholds) with values consistent with the institution's size and risk profile.
• Keep only the country variants for the supervisors that apply to the institution (Peru, Ecuador, European Union or United States) and delete the rest. Several may apply at once in regional groups.
• Fields marked [COMPLETE] include points to confirm with your advisor, especially minimum frequencies, notification deadlines to the supervisor and the scope of the rules for generative AI models.
• Before approval, have it reviewed by the risk function, regulatory compliance, in-house legal or an external advisor and, if it exists, the model validation function.
• Approve it at the board or equivalent body, communicate it to the teams that develop or use models and publish the inventory in a repository with access and version control.

Model Risk Management Policy and Model Inventory

Field	Content
Institution	[LEGAL ENTITY NAME] ([ORGANIZATION NAME])
Primary supervisor	[COMPLETE]
Policy owner	[RESPONSIBLE FUNCTION]
Head of model risk management	[OWNER]
Approving body	[APPROVED BY]
Approval date	[DATE]
Review frequency	[REVIEW FREQUENCY]
Contact	[AI GOVERNANCE EMAIL]

1. Purpose

1.1 This policy sets out how [ORGANIZATION NAME] manages model risk: the possibility of losses, harm to customers, penalties or reputational damage from decisions based on models with design, data or implementation errors, or from misuse of sound models.

1.2 Its purpose is that every model is inventoried, has an owner, is classified by materiality, is independently validated with a depth proportional to its risk, is monitored and is retired in an orderly way.

2. Scope and definition of model

2.1 For this policy, a model is a quantitative, statistical, mathematical, machine learning or artificial intelligence method that processes input data and produces estimates, scores, classifications, predictions, recommendations or content used to make decisions or to inform management or the supervisor.

2.2 It includes, among others:

• origination, credit scoring and behavioral models;
• expected loss, provisioning and capital models;
• pricing, ratemaking and technical reserve models;
• fraud detection and anti-money laundering models;
• market, liquidity and operational risk models;
• AI and machine learning models used in customer service, collections, marketing or workforce management when they influence relevant decisions;
• models developed by third parties, including those embedded in vendor products, and generative AI services used for tasks that affect customers or decisions.

2.3 End-user computing tools (for example, complex spreadsheets) are included when they meet the definition in 2.1 and their output is used in relevant decisions.

2.4 AI systems that do not meet the definition of model, such as productivity assistants with no effect on decisions, are governed by the "Responsible AI Use Policy (Including Generative AI)" and recorded in the "AI System Inventory". [RESPONSIBLE FUNCTION] resolves borderline cases and records the decision in the inventory.