SR 11-7 and model risk management
In 2011 the Federal Reserve and the OCC jointly issued supervisory guidance on model risk management. The Fed’s version is SR 11-7, the name in common use. It asks banks for three things: build and use models properly, validate and challenge them, and govern them with policies, controls, and an inventory with clear ownership.
The principles still apply. The models changed. SR 11-7 assumed a model the bank builds, freezes, validates, and deploys: a credit scorecard, a stress-testing model, a pricing engine. An LLM does not follow that lifecycle. It still meets the definition of a model under the guidance, and examiners treat it as one. Risk teams are accountable for systems their current tools do not cover. That gap is the subject of this article.
Where the usual tools fall short
Development and use. SR 11-7 assumes the bank builds the model or at least understands it. Most LLMs are vendor-built, updated on the vendor’s schedule, and combined at run time with retrieved documents, prompts, and tools. The customer sees the base model plus everything wrapped around it at the time of the answer. Two banks using the same vendor model can carry different risk profiles.
Validation. Standard validation tests a frozen model against a known dataset before go-live, then rechecks periodically. An LLM’s behavior shifts with every prompt change, retrieval update, and vendor release. A one-time validation describes the system on the day of the test, nothing more. The effective challenge SR 11-7 asks for has to run continuously.
Governance and inventory. LLM use enters a bank through vendor products, internal tools, and individual teams. A complete inventory cannot come from asking teams what they run. It has to come from observing what runs.
What examiners are starting to ask
The exam questions follow from these gaps.
- Show every AI system that touches a credit decision.
- Show the policy that governed this decision, with proof it was checked at decision time, not reconstructed later.
- Show who reviewed the decisions your policy classifies as high risk.
- Show how you detected behavior change after the vendor’s last update.
Documents alone answer none of these. Each needs a record captured when the decision was made. Model risk management is moving from the build process to the decision.
Translating the three pillars
The guidance does not need rewriting. The work under it moves to the decision.
Development and use: register every AI-assisted decision workflow with its purpose, components, and risk tier. The same model carries different risk in different uses, so governance attaches to the workflow and the business decision, not the model. An underwriting workflow and a customer-service workflow can share a base model and carry different rules, review levels, and evidence requirements.
Validation: apply the policies from the existing model risk framework to every decision as it happens. Drift, bad outputs, and policy breaks surface immediately with context. Deep validation reviews continue, working from a full record instead of a sample.
Governance: the inventory stays current because systems are observed, not attested. Human review of high-stakes decisions is a recorded step with a name and a time. That is the challenge trail an examiner asks for. An exam request becomes a lookup because the evidence already exists.
The reporting shift
The report changes. The old report: the model was validated, the controls were tested, no exceptions in the sample. The new report: every decision in this workflow was checked against policy as it was made, these were held for review, and any of them can be produced on request. The old report covers the model. The new one covers the decisions, which is what regulators care about.
Where to start
Pick the workflow examiners already ask about. For most banks that is credit decisioning. Register it, tie the existing model risk policies to it, record every run. When any decision can be produced in minutes with inputs, policy checks, and sign-offs attached, SR 11-7 has the evidence it assumed banks kept.