RBI Model Risk Readiness Check

Good looks like: One document, approved by the Board, that applies to every model the entity uses.

Evidence to keep: The framework document and the Board minute that approved it.

Good looks like: Each of the six parts has its own section or policy under the framework.

Evidence to keep: A table mapping each required part to a section or policy.

Good looks like: A risk appetite statement with limits for model risk, informed by stress scenarios.

Evidence to keep: The risk appetite statement and the stress-test or scenario papers behind it.

Good looks like: A review cycle is written down and the last review is on record.

Evidence to keep: Board minutes showing approval of the tiering policy and the last framework review.

Good looks like: No high-risk model goes live without the committee's approval on record.

Evidence to keep: Committee minutes for each high-risk model approval.

Good looks like: A yearly tiering report with the committee's review recorded.

Evidence to keep: The latest tiering report and the minute of its review.

Good looks like: A standing agenda item covers these models and any breach reports.

Evidence to keep: Committee agendas and breach reports from the last year.

Good looks like: Named owners, a budget, and a yearly policy review reported to the committee.

Evidence to keep: Procedure documents, staffing plan and the policy review report.

Good looks like: The framework says the entity is answerable for all model outcomes, without exception.

Evidence to keep: The clause in the framework and vendor contracts that reflect it.

Good looks like: A report that adds up model risk, flags models over the limit, and records what was done.

Evidence to keep: The latest model risk report and any committee paper on models over the limit.

Good looks like: An organisation chart that shows the three lines and their independence.

Evidence to keep: The organisation chart and the charter of the validation function.

Good looks like: A testing calendar and results for each model, including back-tests.

Evidence to keep: The testing calendar and the latest test results.

Good looks like: Each inventory row shows a tier and the date it was last reviewed.

Evidence to keep: The inventory with tier and review date columns filled in.

Good looks like: A table that says what each tier means for validation, approval, monitoring and documentation.

Evidence to keep: The tier-to-treatment table in the framework.

Good looks like: A scoring method where a low complexity score cannot pull down a highly material model.

Evidence to keep: The tiering method and a worked example.

Good looks like: A single register that every business unit feeds, with a rule that nothing runs outside it.

Evidence to keep: The inventory and the rule in the framework.

Good looks like: Every column filled for every model. Use the inventory builder below to check.

Evidence to keep: An export of the inventory with no blank required columns.

Good looks like: A retention rule of ten years or more, and retired models still visible in the register.

Evidence to keep: The retention policy and a filter of retired models in the inventory.

Good looks like: A documentation standard and a file for each model that meets it.

Evidence to keep: The documentation standard and a sample of model files.

Good looks like: The grievance policy names model-related complaints, and a harm check runs before launch.

Evidence to keep: The grievance policy and the pre-launch harm check.

Good looks like: A short business case for each model with a fairness and bias note.

Evidence to keep: Business case documents for recent models.

Good looks like: A development standard and sign-off that data governance rules were followed.

Evidence to keep: The development standard and a data governance sign-off.

Good looks like: A validation record for every model, signed by the independent function.

Evidence to keep: Validation reports and the independence rule in the charter.

Good looks like: A validation calendar that shows each trigger and the last date for each model.

Evidence to keep: The validation calendar.

Good looks like: A validation template with these four parts, filled for each model.

Evidence to keep: The validation template and completed reports.

Good looks like: A log of validation completion dates and committee dates, all within three months.

Evidence to keep: The validation log with both dates.

Good looks like: An approval matrix and a decision record for every model and exception.

Evidence to keep: The approval matrix and recent decision records.

Good looks like: A deployment checklist with a production-match test signed off.

Evidence to keep: The deployment checklist and the match test result.

Good looks like: Monitoring dashboards or reports for each live model, with the committee watching exception models.

Evidence to keep: Monitoring reports and the committee's review of exception models.

Good looks like: A change log per model, and a material-change rule that restarts validation and approval.

Evidence to keep: The change policy, a sample change log and the material-change rule.

Good looks like: A continuity section for models with manual or backup options, and a retirement notice process.

Evidence to keep: The continuity plan section and a recent retirement notice.

Good looks like: A due diligence report for each outside model, done before the contract.

Evidence to keep: Due diligence reports.

Good looks like: A contract checklist with these three items ticked for every outside model.

Evidence to keep: Contract clauses or a contract review table.

Good looks like: In-house validation reports for outside models, and the committee's oversight record.

Evidence to keep: Validation reports and committee minutes.

Good looks like: An AI use policy that lists allowed use cases and the extra controls for each.

Evidence to keep: The AI use policy and the list of approved use cases.

Good looks like: Extra tiering questions for AI models and a vendor concentration note.

Evidence to keep: The AI tiering questions and the concentration assessment.

Good looks like: A test report for each AI model covering all seven behaviour risks.

Evidence to keep: The AI test report and the drift monitoring dashboard.

Good looks like: Red-team results, an auto-update rule, and documentation that lets a third party reproduce the model.

Evidence to keep: Red-team reports, the auto-update policy and the model documentation.

Good looks like: A security sign-off for each AI deployment. An AI notice and a human hand-off in every customer channel.

Evidence to keep: The security sign-off and screenshots of the notice and hand-off.

Good looks like: A named human owner, a tested kill switch, and a quarterly review of overrides and incidents.

Evidence to keep: The oversight procedure, the kill-switch test record and the override log.