Model risk management (MRM)

Model risk management (MRM) is the governance practice of validating, monitoring, and controlling the risk that a statistical or machine-learning model is wrong or misused. It treats the model itself, not just the decisions it informs, as a source of risk, since a flawed or misapplied model can cause bad decisions at scale — from mispriced loans to missed fraud.

Typical practice includes an independent validation function that reviews a model's design, data, and assumptions before deployment, ongoing model monitoring for performance drift afterward, periodic backtesting against actual outcomes, and documentation of the model's limitations and intended use. Explainable AI techniques are often required for higher-risk models so reviewers and regulators can understand why a model produces a given output, not just that it performs well on average.

MRM is most formalized in banking and insurance, where regulators expect structured model risk frameworks, but the same discipline increasingly applies to any organization deploying consequential machine learning, as part of broader Responsible AI practice. A common pitfall is validating a model once at launch and leaving it largely unreviewed as the data it sees in production drifts away from what it was trained and validated on.