SmartSuite for the Model Risk Manager

The inventory assigns a model owner, business owner and independent reviewer to each model with documented responsibilities, so the tier you set decides the validation cadence and nobody disputes who answers for the model.

Governance coverage tracking shows which models have required assessments, approvals, controls and monitoring cycles completed and which do not, so shadow models and lapsed validations surface on the dashboard rather than in an examination.

Audit trails and version history record every change to a model, its use or its documentation, so your re-validation triggers fire on the change itself and the Model Validator is scheduled rather than surprised.

Model risk sits in the enterprise register with tolerance thresholds and automated alerts for deviations, so the Chief Risk Officer sees a model breaching appetite in the same view as every other risk domain.

Approval, conditional approval, exception and suspend-or-retire decisions run through a workflow with full traceability, so when a Model Owner asks why their model was conditioned the decision, the reviewer and the condition are on the record.

Supporting evidence, model documentation, testing artifacts and review logs are stored against each model, so the Internal Auditor and the AI Risk Officer review the validation file in place rather than requesting it from three inboxes.

Framework and regulatory alignment links models and assessments to SR 26-2, the NIST AI RMF, ISO/IEC 42001 and internal policy, so the governance requirements you set are traceable to the standard an examiner will test against.

Use the AI Assistant in a SmartDoc field to summarize assessments, highlight risk trends and draft board-level updates from the register, so the model risk section of the committee pack starts as a draft grounded in the inventory.

Scalable governance without redesign lets you adapt assessment requirements as the EU AI Act, NAIC bulletins or OMB guidance change, so a new obligation is a configuration update to the framework, not a rebuild of it.

Chief Risk Officer

The Model Risk Manager runs the model risk management framework: the model inventory with its risk tiers and owners, the validation standards and schedule, independent validation and the findings that follow, ongoing monitoring of performance and use within approved scope, the governance of model changes and re-validation triggers, and the reporting of model risk posture to the risk committee. The scope covers every model, statistical or AI, under SR 26-2, SS1/23, NIST AI RMF and the EU AI Act.

AI Governance provides a model registry with tiering, assessment templates and task routing, so validation and monitoring run on a schedule rather than by request. Each model is tiered, its validation is due on a date, the assessment is a template the Model Validator completes, and the tasks route to the Model Owner when their input is needed. CRI AI RMF supplies the assessment structure where that profile applies, and the Model Risk Manager sees which validations are due and overdue.

Model risk is scored and validation findings are linked to the enterprise risk register in Enterprise Risk Management (ERM), so a model with an open high-severity finding appears as a risk the Chief Risk Officer sees, not only as a line in the model inventory. The AI Risk Officer and AI Governance Lead work from the same scores, and a model's tier, its findings and its enterprise risk rating describe one exposure.

Validation findings and remediation are tracked in Issues Management with owners, evidence and closure sign-off, so each finding has the Model Owner responsible, the remediation agreed, the evidence submitted and a sign-off before it is closed. The Model Risk Manager can see open findings by model and tier, and the Internal Auditor can follow a finding from the validation that raised it to the evidence that closed it, which is what an audit of the framework requires.

SmartSuite reports model inventory coverage, overdue validations and open findings to the risk committee from the registry, schedule and issues as they stand. The Model Risk Manager can show the Chief Risk Officer or Chief Data and AI Officer how much of the inventory has a current validation, which validations are overdue by tier and how many findings remain open and for how long. The report is a view of the framework in operation.

New customers can start with SmartSuite Onboarding, a guided four-week program around one or two priority workflows. For a model risk function the first workflow is the inventory: load the models with their owners, tiers and last validation dates, which immediately shows what is overdue, then set the validation schedule and the assessment templates the validators will use. Open findings from previous validations are loaded with owners so remediation tracking starts complete, and AI models join the same inventory as statistical ones.