A large regional bank has deployed an AI-driven credit scoring model that was fully validated twelve months ago under SR 11-7 guidelines. The model has since processed over 2 million loan applications with no formal re-review. The Chief Risk Officer asks the model risk team what SR 11-7 requires regarding ongoing monitoring for this model. Which of the following best describes the SR 11-7 ongoing monitoring obligation?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Think of SR 11-7 like a car's maintenance schedule — you don't just tune it up once and forget it. The guidance mandates continuous performance tracking and re-validation triggers when the model's environment or outputs drift. Answer B nails this ongoing obligation.
Full explanation below image
Full Explanation
SR 11-7 (Supervisory Guidance on Model Risk Management, Federal Reserve / OCC, 2011) establishes a lifecycle framework for model risk management that extends well beyond initial validation. The guidance explicitly requires financial institutions to implement ongoing monitoring programs that track whether a model continues to perform as intended after deployment. This includes comparing predicted outputs to actual outcomes, monitoring input data for distribution shifts, and evaluating whether the economic or regulatory environment in which the model operates has materially changed.
The standard does not permit a one-time validation to satisfy all future oversight obligations (eliminating option A). Nor does it create bright-line triggers based purely on processing volume or bank size (eliminating options C and D). Instead, SR 11-7 takes a risk-based approach: more consequential models — such as high-volume credit scoring systems — warrant more frequent and rigorous ongoing monitoring.
For an AI credit scoring model processing millions of applications, regulators expect the institution to define performance metrics (e.g., Gini coefficient, KS statistic, PSI for population stability), establish acceptable thresholds, and escalate to re-validation when those thresholds are breached. Failure to maintain ongoing monitoring exposes the bank to model risk events — discriminatory lending outcomes, capital miscalculation, or regulatory enforcement action.
For CFIA candidates, SR 11-7 is foundational. Understand that ongoing monitoring is not optional maintenance but a regulatory mandate covering three pillars: performance tracking, outcome analysis, and change management. Any material change in the model's inputs, business process, or macroeconomic context resets the validation clock.