SR 11-7 and Model Risk Management Guidance
The US bank regulatory guidance that formalized how financial institutions should govern the models they rely on — independent validation, ongoing monitoring, and documentation — and why its principles spread well beyond the banks it was written for.
SR 11-7 is guidance jointly issued by the Federal Reserve and the Office of the Comptroller of the Currency in 2011, written for banks, that lays out what a sound model risk management program should look like. It came after years of models — credit models, risk models, pricing models — being used with far less scrutiny than the decisions they drove deserved, and it defines model risk broadly: the risk of loss from a model being wrong, or from a correct model being used incorrectly. Though written specifically for regulated banks, its structure has become something close to an industry-wide reference point for how any serious financial institution, including hedge funds and asset managers with no direct obligation to follow it, thinks about model governance.
The guidance's core structure has three pillars. First, robust development: models should be built on sound theory, tested rigorously, and documented well enough that someone other than the builder can understand what the model does and why. Second, independent validation: every model needs review by people organizationally separate from those who built and use it, specifically empowered to challenge the model's assumptions and find its weaknesses. Third, ongoing monitoring: a model validated once at launch isn't validated forever, since the world the model operates in keeps changing, so approval has to be revisited on a schedule and whenever performance deteriorates.
A concrete example: a firm building a credit-risk scoring model, applying SR 11-7 principles even though it's not a regulated bank, documents the model's assumptions and limitations in a formal model document, has an independent risk team validate it before deployment (checking, among other things, that the training data doesn't leak future information), and sets a schedule for revalidation every twelve months or immediately if the model's tracked error rate crosses a set threshold. When a revalidation review a year later finds the model's accuracy has quietly degraded due to a shift in the applicant population, the pre-agreed monitoring schedule is what catches it — not a coincidental discovery.
SR 11-7 formalized model risk management around three pillars — sound development, independent validation, and ongoing monitoring — and while it was written as bank regulatory guidance, its structure has become a widely adopted template for how any firm governs the models and strategies it depends on.
Further reading
- Board of Governors of the Federal Reserve System, SR 11-7: Guidance on Model Risk Management (2011)