A model can be well designed and still produce poor results if its inputs are flawed. That is why data sits at the center of model risk management.
SR 11-7 is supervisory guidance on model risk management issued by the Federal Reserve, with the OCC's counterpart as Bulletin 2011-12. It describes expectations for model development, implementation and use, model validation, and governance, policies and controls. Many banks also apply its principles to AI and machine learning models.
Where data appears in the guidance
Data runs through every part of the model lifecycle:
- Development. Data used to build a model should be suitable and relevant for its purpose, with quality assessed and limitations documented.
- Validation. Validators need to understand and challenge the data a model relies on.
- Ongoing monitoring. Input data can drift or break after deployment, so it needs continued attention.
- Governance. Roles, policies and documentation should make accountability clear.
Common data weaknesses in model programs
- Inputs sourced from spreadsheets or extracts with no clear owner.
- Lineage that nobody can reconstruct once the model builder has moved on.
- Quality checked once at development and never again.
- A model inventory that lists models but not the data they depend on.
Why certify model inputs
Treating each critical model input as a certified data asset gives validators and examiners a single record containing:
- A clear definition and intended use.
- An accountable owner.
- Lineage from source to model.
- Quality evidence and monitoring results.
- A dated approval.
That record shortens validation, reduces repeat questions and makes it clear when an input changes enough to affect a model. For background, see what data certification is.
Connect the model inventory to data
Extend your model inventory with the certified data assets each model uses. Then, when an asset fails a control, moves systems or is retired, you can immediately see which models are exposed. This is the approach behind our SR 11-7 model risk data governance page.
Think about AI models too
AI and machine learning models often depend on large, varied data sets, which raises the stakes for lineage and quality. Documenting training and input data as certified assets is a practical way to extend model governance to these systems.
Practical steps
- List your highest-risk models.
- Identify each model's critical inputs.
- Name owners and document lineage.
- Attach quality evidence and monitoring.
- Certify and set re-certification triggers.
Supervisors also look at ownership and evidence more broadly, as discussed in our article on OCC heightened standards and data governance. To discuss your model data, get in touch.
This article is a general overview and not legal advice.