SmartSuite for the Model Risk Manager
The Model Risk Manager runs the model risk management framework: the model inventory, tiering, validation schedule and the findings that follow. They make sure every model, statistical or AI, is validated independently, used within its approved scope and monitored for performance.
What you own
The Model Risk Manager runs the model risk management framework: the model inventory, tiering, validation schedule and the findings that follow.
- Maintain the model inventory with risk tiers and owners
- Set the model validation standards and schedule
- Coordinate independent validation and track validation findings
- Monitor ongoing model performance and use within approved scope
- Govern model changes and re-validation triggers
- Report model risk posture to the risk committee
At a glance
The GRC processes this role owns, touches and depends on.
Owns
accountable for the process
Touches
contributes or approves
Depends on
consumes its output
How the GRC processes connect
Three lines of defense set the frame; the chain shows where each process hands off to the next. Colors follow the role: navy is owned, blue is touched, gray is depended on.
Reporting lines
Who this role reports to, who reports to them, and the peers they work with most.
Reports to
Direct reports
Works closely with
How SmartSuite supports this role
Lead
AI governance. Provides a model registry with tiering, assessment templates and task routing so validation and monitoring run on a schedule rather than by request.
Risk management. Scores model risk and links validation findings to the enterprise risk register.
Issues and actions. Tracks validation findings and remediation with owners, evidence and closure sign-off.
Reporting. Reports model inventory coverage, overdue validations and open findings to the risk committee.
Products this role uses most
Industry reference
The Federal Reserve, OCC and FDIC's revised guidance (SR 26-2 and OCC Bulletin 2026-13, April 2026, superseding SR 11-7) defines model risk management on a risk-based scale: an inventory, independent validation, ongoing monitoring and governance for every model's intended use. The UK PRA's SS1/23 (2023, updated April 2026) sets equivalent principles for banks, and actuaries follow ASOP 56 on modeling.
The scope now includes AI, with the 2026 US guidance leaving generative and agentic AI models to the organization's AI governance program. NIST's AI RMF and ISO/IEC 42001 extend validation and monitoring to machine-learning systems, and the EU AI Act makes high-risk systems subject to conformity assessment. Insurers apply the NAIC's 2023 AI model bulletin; healthcare models that inform care fall under FDA device guidance; public bodies follow OMB AI guidance.
Related roles
Explore Further
Guides and definitions from the GRC Knowledge Center and the What-is glossary, chosen for this role.
Frequently asked questions
What is the Model Risk Manager accountable for?
The Model Risk Manager runs the model risk management framework: the model inventory with its risk tiers and owners, the validation standards and schedule, independent validation and the findings that follow, ongoing monitoring of performance and use within approved scope, the governance of model changes and re-validation triggers, and the reporting of model risk posture to the risk committee. The scope covers every model, statistical or AI, under SR 26-2, SS1/23, NIST AI RMF and the EU AI Act.
How does SmartSuite help a Model Risk Manager run the inventory and validation schedule?
AI Governance provides a model registry with tiering, assessment templates and task routing, so validation and monitoring run on a schedule rather than by request. Each model is tiered, its validation is due on a date, the assessment is a template the Model Validator completes, and the tasks route to the Model Owner when their input is needed. CRI AI RMF supplies the assessment structure where that profile applies, and the Model Risk Manager sees which validations are due and overdue.
How is model risk scored and linked to the enterprise register?
Model risk is scored and validation findings are linked to the enterprise risk register in Enterprise Risk Management (ERM), so a model with an open high-severity finding appears as a risk the Chief Risk Officer sees, not only as a line in the model inventory. The AI Risk Officer and AI Governance Lead work from the same scores, and a model's tier, its findings and its enterprise risk rating describe one exposure.
How are validation findings tracked to closure in SmartSuite?
Validation findings and remediation are tracked in Issues Management with owners, evidence and closure sign-off, so each finding has the Model Owner responsible, the remediation agreed, the evidence submitted and a sign-off before it is closed. The Model Risk Manager can see open findings by model and tier, and the Internal Auditor can follow a finding from the validation that raised it to the evidence that closed it, which is what an audit of the framework requires.
How does this role report model risk posture to the risk committee?
SmartSuite reports model inventory coverage, overdue validations and open findings to the risk committee from the registry, schedule and issues as they stand. The Model Risk Manager can show the Chief Risk Officer or Chief Data and AI Officer how much of the inventory has a current validation, which validations are overdue by tier and how many findings remain open and for how long. The report is a view of the framework in operation.
How quickly can a model risk function get started with SmartSuite?
New customers can start with SmartSuite Onboarding, a guided four-week program around one or two priority workflows. For a model risk function the first workflow is the inventory: load the models with their owners, tiers and last validation dates, which immediately shows what is overdue, then set the validation schedule and the assessment templates the validators will use. Open findings from previous validations are loaded with owners so remediation tracking starts complete, and AI models join the same inventory as statistical ones.
See SmartSuite for your role
Start a free trial, or book a demo and we will walk through your role's workflows in SmartSuite.