Model Risk Governance: When the Model Becomes the Risk
In this article
At a glanceThe model risk problem has two distinct shapesWhat genuine model risk governance looks likeWhy AI makes this more urgentWhat regulators are watchingWhere this leaves risk leadersBoardroom questionsContinue readingAt a glance
A governance perspective on model inventories, independent validation, model use and overrides, and the oversight needed as AI adoption grows.
Every major risk decision in a modern bank is shaped by a model. Credit scoring, loan pricing, stress testing, fraud detection, liquidity forecasting, capital allocation. The models are not the support act. They are, in most institutions, the primary mechanism through which risk is assessed and managed.
That makes model risk, the risk that a model is wrong, misused, or misunderstood, one of the most consequential and least governed risks in the GCC banking sector today. And the rapid adoption of AI and machine learning across the region is making it more consequential, faster than governance frameworks are keeping up.
This is not a technical article about model validation methodology. It is a governance article about who is responsible for model risk, what boards and risk committees should be asking about it, and why the institutions that get this right will have a meaningful advantage over the ones that don't.
The model risk problem has two distinct shapes
The first shape is the model that's technically wrong. Assumptions that don't hold, data that's biased, a methodology that worked in one market environment and doesn't transfer to another. This is the version of model risk that most validation frameworks are designed to catch, and the one that gets the most attention in technical governance discussions.
The second shape is the model that's technically sound but used incorrectly. A credit scoring model applied outside the population it was built on. A stress test scenario that's run correctly but whose output is interpreted too literally by the risk committee. A fraud detection model whose flags are systematically overridden by relationship managers without that override pattern being tracked or reviewed. This second shape is harder to catch because the model itself passes validation. The failure is in the human and organizational layer around it.
In my experience, the second shape causes more damage, more often, than the first. And it is the one that most model risk frameworks are weakest on.
What genuine model risk governance looks like
A genuine model risk governance framework has four components that need to work together rather than exist in parallel.
The first is a model inventory that's actually complete. This sounds basic and it consistently isn't. Most institutions have a formal inventory of their regulatory models, the ones that feed capital calculations or stress testing submissions. They have partial or no visibility of the operational models that sit in business lines, the pricing tools, the customer segmentation models, the early warning indicators built in Excel by a credit analyst five years ago that now sit at the centre of a critical process. You cannot govern model risk you cannot see.
The second is a validation function that's genuinely independent. Model validation that sits within the same team that builds the models is not independent validation. It is quality assurance. Independent validation requires organizational separation, access to the data and assumptions underlying the model, and the authority to require remediation before a model goes into production. In practice, I still see institutions where model developers and validators share reporting lines, and where the pressure to move quickly to production consistently wins over the pressure to validate thoroughly.
The third is a use and override monitoring framework. For every model in production, the institution should be tracking how it's actually being used: who is overriding its outputs, at what rate, for what reasons, and whether override patterns reveal systematic misuse or a systematic flaw in the model itself. A fraud model whose outputs are overridden 40 percent of the time is telling you something important, either about the model or about the behavior of the people using it. Most institutions aren't listening.
The fourth is board and risk committee oversight that goes beyond approving a model risk policy. The board should receive regular reporting on the model inventory, material model changes, validation findings that haven't been remediated, and the institution's highest-risk models. Not in technical detail, but at a level that allows the board to ask whether model risk is being managed rather than simply assuming it is because a policy exists.
Why AI makes this more urgent
The adoption of machine learning and AI models across GCC banking is accelerating. Credit decisioning, AML transaction monitoring, customer behaviour prediction, operational risk early warning systems. These models are more powerful than traditional statistical models and significantly harder to govern using traditional frameworks.
The explainability challenge I raised in Article 1 of this series, the question of whether you can explain why a model flagged something to a regulator, a board, and a customer, is a model risk governance question as much as an AI question. A machine learning model that improves credit loss predictions by 15 percent but cannot be explained to the credit committee reviewing its output is not ready for production in a governed institution, regardless of its statistical performance.
The institutions that are getting AI model governance right are not the ones with the most sophisticated models. They are the ones that have extended their model risk framework to explicitly cover AI and machine learning, including explainability requirements, bias testing, and performance monitoring that accounts for model drift as the environment changes. That work is unglamorous. It is also what determines whether AI adoption creates genuine risk intelligence or genuine risk.
What regulators are watching
Regional regulators including the CBB are paying increasing attention to model risk governance as AI adoption accelerates. The direction of travel internationally, through guidance from the Fed, the OCC, the EBA, and the Basel Committee, is toward formal model risk management expectations that cover the full model lifecycle, from development through validation, production, monitoring, and retirement. GCC institutions that are building that framework now, rather than retrofitting it after a regulatory finding, are significantly better positioned.
Where this leaves risk leaders
If you're assessing your institution's model risk governance posture, 1. four questions cut to what matters: 2. is your model inventory genuinely complete, including operational and business line models, not just regulatory ones; 3. is your validation function organizationally independent from model development; 4. are you monitoring how models are actually being used, including override rates and patterns; and does your board receive regular, meaningful reporting on model risk rather than a one-time policy approval.
Most institutions will find gaps in at least two of those four. The one that matters most to start with is the inventory. You cannot govern what you cannot see.
What is the biggest model risk governance gap you see in your institution or across the institutions you work with?
Boardroom questions
- Does our inventory include business-line and operational models?
- Can independent validation require remediation before deployment?
- What do override patterns and unresolved findings tell the board?