AI Model Risk Audit for Financial Institutions

For fifteen years, financial institutions managed model risk under SR 11-7, a framework designed with statistical models in mind. In April 2026 the Federal Reserve, OCC and FDIC replaced it with SR 26-2 and OCC Bulletin 2026-13, which take a risk-based approach tailored to each institution’s size, complexity and model risk profile. AI and machine learning introduce additional complexity: models that learn continuously from data, make decisions through processes that aren’t fully transparent, and evolve in ways that traditional validation frameworks were not built to evaluate.

SR 26-2 applies to traditional statistical and quantitative models and to non-generative AI models. It places generative and agentic AI outside its scope, so those systems still need governance through an institution’s broader risk management practices and recognized frameworks such as the IIA’s AI Auditing Framework and the NIST AI Risk Management Framework. AuditOne provides independent audits of model risk management programs at financial institutions, with AI and ML specific audit coverage for institutions where AI models represent a significant share of the model inventory.

Model Inventory & Classification

• Completeness of model inventory for AI and machine learning models
• Risk-based tiering and classification of AI models
• Documentation standards: purpose, inputs, outputs, and decision logic
• Coverage of vendor-provided AI models in the inventory
• Identification of models in use that are not formally in the inventory

Model Development & Validation

• Development documentation and methodology for AI/ML models
• Independent validation coverage and depth relative to model risk tier
• Explainability and interpretability documentation for decisioning models
• Bias testing, fairness assessment, and disparate impact evaluation
• Data governance and data quality controls for model training data

Model Governance & Approval

• AI model approval workflow and governance oversight
• Board or committee-level visibility into the AI model portfolio
• New model approval process, including AI models embedded in vendor products
• Policies covering acceptable AI model use, prohibited applications, and oversight requirements

Ongoing Monitoring & Performance

• Performance monitoring for AI models in production
• Outcome review and feedback loop documentation
• Model drift detection protocols and retraining triggers
• Alerting and escalation procedures for model performance degradation
• Periodic model review and re-validation scheduling

Model Change Management

• Change management procedures for AI model updates and retraining
• Version control and documentation for AI model changes
• Re-validation requirements and thresholds for material model changes
• Vendor notification requirements when third-party AI models are updated