Model Governance and SR 11-7
The US bank regulatory framework (Federal Reserve guidance SR 11-7) that requires models used for financial decisions to be independently validated, documented, and monitored — and why ML models make this harder to satisfy.
Any model that influences a real financial decision — a credit score, a trading signal, a capital calculation — can be wrong in ways that cost real money, and a wrong model that nobody is checking can keep being wrong for years before anyone notices. SR 11-7 is the Federal Reserve's guidance letter that formalizes what US banks are expected to do about that risk: it defines "model risk management" as an ongoing discipline, not a one-time sign-off, and it applies to every model a bank relies on, including machine-learning models.
The core requirement is separation of duties: the team that builds a model cannot also be the team that validates it. An independent validation function has to review the model's conceptual soundness (does the underlying approach make sense for the problem), test its performance on data the developers didn't use, and check that it's being used the way it was designed to be used. Models are also tiered by how much impact they have — a model that sets aside minor accounting reserves gets a lighter review than one that sets regulatory capital — and every model needs an inventory entry, an owner, and documentation thorough enough that someone who didn't build it could understand and re-derive its logic.
Machine-learning models strain this framework in specific ways SR 11-7 wasn't originally written with in mind. A gradient-boosted tree or neural network is much harder to describe in the "conceptual soundness" documentation SR 11-7 expects than a linear regression, because there's no simple equation to point to — validators increasingly rely on techniques like feature-importance analysis and stress testing on edge cases to substitute for the interpretability a simpler model would have offered for free. Models that retrain frequently on fresh data also complicate the idea of a fixed, one-time validation, since a model approved in January may behave meaningfully differently by June.
What this means in practice
Any quant building models inside a regulated bank should expect independent validation, model inventories, and periodic re-review to be a standing part of the job, not a formality at launch — and should expect ML-specific scrutiny around explainability and retraining cadence that a simpler linear model wouldn't face. Outside regulated banks, the same principles (independent review, documentation, ongoing monitoring) are widely adopted as best practice even where SR 11-7 itself doesn't formally apply.
SR 11-7 requires that models be independently validated by a team separate from the one that built them, documented well enough to be understood by someone else, and monitored on an ongoing basis — a discipline that machine-learning models satisfy less easily than simpler statistical models because of their opacity and tendency to retrain.
Further reading
- Federal Reserve SR 11-7, Guidance on Model Risk Management (2011)