TL;DR
- What it is: Model risk is the potential for loss or bad decisions when a model is wrong, or is right but used wrongly. Models are simplified pictures of reality, and the gap between the picture and the real world is where the risk sits.
- Where it comes from: Three sources. A model can be built wrong, used wrong, or become wrong as conditions change. The RBI’s 2026 draft names that third one “time-suitability.”
- Where it shows up: In a lending book it enters at four points: origination, portfolio scoring, provisioning and capital, and third-party models.
- What it is not: Model risk is not credit risk. Credit risk is the borrower not paying. Model risk is your measurement of that being wrong.
- One caveat: The RBI guidance referenced here is a draft, with public comments closed 24 July 2026, not yet in force.
A lending model is a simplified picture of a borrower. It takes a handful of measurable things and turns them into a number that stands in for a decision no one has time to make by hand. That works right up until the picture stops matching the borrower. Model risk is the cost of that gap, and in a lending book it enters at more than one door.
What Model Risk Actually Is
Model risk is the potential for adverse consequences, financial loss, poor decisions, or reputational damage, from decisions based on a model that is either wrong or used wrongly. A model is a method that turns input data into a quantitative estimate: a score, a probability, a provision. It is a simplified representation of a real-world relationship, and simplification is the point. A model that captured every detail of a borrower would be as slow and unusable as the manual judgment it replaced.
The risk lives in that simplification. Every model leaves something out, and model risk is what happens when the thing it left out turns out to matter. This is different from a model simply being imprecise. A model can be accurate to three decimal places and still carry serious model risk if it is measuring the wrong thing, or measuring the right thing in a world that has moved on.
Where Model Risk Comes From
Model risk has three sources, and they are worth keeping separate because each one is caught and fixed differently.
The first is model error. The model itself is built wrong: a flawed assumption, a coding mistake, the wrong technique for the problem. It produces inaccurate outputs no matter how carefully it is used.
The second is misapplication. The model is sound but used outside what it was built for. A scorecard trained on one borrower population, then pointed at a different one, is a correct model producing meaningless numbers, because it is being asked a question it was never designed to answer.
The third is time-suitability, the source the Reserve Bank of India’s 2026 draft guidance names explicitly. A model that was right at launch becomes less fit for purpose as the world it scores changes, even though nothing about the model itself broke. This is the source that hides best, because the model keeps producing confident numbers the whole time it is going stale. It shows up in practice as model drift.
The Four Places Model Risk Enters a Lending Book
Sources explain why model risk arises. For a lender, the more useful question is where it enters, because that is where you can actually watch for it. In a lending book, there are four doors.
At origination, in the approval decision
The application scorecard at the front door decides who gets credit and who is turned away. Model risk here is expensive in a specific way: a scorecard that underestimates risk in a segment approves borrowers who should have been declined, and those loans are already on the book before anyone sees the losses. The models that make these calls, and the ways they fail, are covered in risk modeling in lending.
In the portfolio, in behavioral and collections scoring
Once a borrower is on the book, behavioral models take over: setting credit limits, flagging accounts for renewal, prioritizing which delinquent accounts collections should work first. Model risk here is quieter than at origination, but it compounds across the whole live portfolio at once, because these models run continuously on every account.
In provisioning and capital, where model outputs hit the balance sheet
The models that estimate expected loss, the probability of default, the loss given default, and the exposure, feed directly into provisioning and capital. Model risk at this door is not just a bad lending decision. It is a misstatement of the numbers the institution reports to its board and its regulator. A model that reads recovery rates from a benign period will understate provisions right up until conditions turn.
In third-party and vendor models the institution did not build
Plenty of the models in a lending book come from outside: a bought scorecard, a vendor’s fraud engine, an analytics provider’s segmentation. It is tempting to treat these as someone else’s risk. The RBI’s draft guidance is direct on this point: accountability does not transfer. The institution remains responsible for outcomes even when the model came from a vendor, which means a third-party model needs the same independent validation as one built in-house.
Model Risk Is Not the Same as Credit Risk
These two get conflated constantly, and the distinction matters. Credit risk is the risk that a borrower does not repay. Model risk is the risk that your measurement of that borrower is wrong.
They move independently. A lender can hold a low-credit-risk portfolio and still carry high model risk, if the models telling them the portfolio is low-risk have quietly drifted. In fact that is the more dangerous combination, because the model risk is what is hiding the real picture. Managing credit risk assumes the numbers are right. Managing model risk is what makes that assumption safe to hold.
Managing Model Risk Across the Book
Naming the four doors is where model risk management starts, not where it ends. Watching all four at once, across every model an institution runs, is the discipline of model risk management: the governance, inventory, validation, and monitoring that keep model risk visible instead of letting it accumulate unseen.
A governed platform makes that practical. Every prediction stays traceable to an explanation, so when a number looks wrong the cause is visible immediately. Every model change runs through maker-checker approval before it reaches production, and the full lineage from data to decision sits in an immutable audit trail, so model risk at any of the four doors surfaces as evidence rather than a surprise.
A leading NBFC in India used this approach to rank borrowers by risk and focus collections on the highest-risk segment, seeing a 116% improvement in collections and 86% predictive accuracy, deployed in two weeks. That result held because the model risk around it was watched, not assumed away.
If your team is mapping where model risk sits in your own book, book a working session with our data science team to walk the four doors against your current models.
Sources
- US Federal Reserve / OCC, Supervisory Guidance on Model Risk Management (SR 11-7), 2011. Source for the definition of model risk, the definition of a model as a simplified representation, the two classic sources (fundamental error and misuse), and the three named consequences. Accessed via CIMCON explainer, 2026, and Wikipedia “Model risk,” 2026. General industry framework, US-origin, not India- or RBI-specific.
- Reserve Bank of India, Draft Guidance on Regulatory Principles for Model Risk Management, Press Release 2026-2027/528, issued 24 June 2026; public comments closed 24 July 2026. Reused unchanged from the cluster’s verified facts table (same fact set as articles #1-5, no re-fetch drift): three sources of model risk (model error, misapplication, time-suitability) and third-party accountability. (Secondary summary: corplawupdates.in; verify final wording against the RBI primary document before publish.)
- iTuring case study, “Improve Collections and Optimize Efforts” (Leading NBFC in India): 116% collections improvement, 86% predictive accuracy, two-week deployment. Source: ituring.ai live case study.
