Model Risk Management (MRM)

The framework a firm uses to identify, govern, validate and reduce the risk that its models cause harm. The Prudential Regulation Authority (PRA) defines model risk as "the potential for adverse consequences from model errors or the inappropriate use of modelled outputs to inform business decisions", and says it "can be reduced or mitigated, but not entirely eliminated, through an effective MRM framework". Its supervisory statement SS1/23, in effect since 17 May 2024, sets five principles: model identification and risk classification; governance; model development, implementation and use; independent model validation; and model risk mitigants. It applies to UK banks, building societies and PRA-designated investment firms that have approval to use internal models for regulatory capital. In the Bank of England and FCA's 2026 survey of AI in UK financial services, applying model risk management principles to vendor-supplied models was the governance challenge respondents selected most often, at 54%. For firms that buy AI rather than build it, the practical question is how to validate a model they cannot see inside.