PUBLIC SYNTHETIC INSTITUTION · MODEL RISK EXAMPLE
Largebank001 Evidence Library
A synthetic document environment showing how regulation, governance, policies, controls, evidence and assurance records connect across a global banking group.
HQLondonScale£1tn+FootprintUK · EU · US · Asia
HOW TO READ THE LIBRARY
One bank. Multiple evidence layers.
Documents are grouped by their role in the assurance chain rather than presented as a narrative. Each artefact can be linked to its owner, legal entity, applicable requirement, control, evidence and assurance conclusion.
Regulation→Policy→Procedure→Control→Evidence→Assurance
01
INSTITUTION
Organisation, ownership & history
The context needed before interpreting any policy, control or regulatory requirement.
IDDocument / recordOwnerState
ORG-001
Group legal entity structureHoldings plc; UK Bank plc; Europe S.A.; Americas N.A.; Asia Bank Ltd; Technology Services Ltd
Group SecretariatSynthetic artefactORG-002
Model Risk organisational chartFirst-line model owners and developers; Group Model Risk; Independent Validation; Internal Audit
Group CROSynthetic artefactORG-003
Accountability & committee mapBoard Risk Committee; Group Model Risk Committee; Model Approval Committee; legal-entity committees
Company SecretariatSynthetic artefactHIS-001
Supervisory & adverse historySynthetic timeline of prior findings, remediation themes, material model events and governance weaknesses
Regulatory AffairsSynthetic artefactHIS-002
Model estate change historyAcquisitions, migrations, material methodology changes and inherited model portfolios
Group Model RiskSynthetic artefact02
INTEGRATED REGULATORY LIBRARY
Applicable regulation & supervisory sources
This tab mirrors the regulatory-source layer used by Qlogue and adubio: source, jurisdiction, applicability, effective date and mapped internal obligations.
IDRegulatory sourceApplies toState
REG-UK-001
PRA SS1/23 — Model risk management principles for banksFive-principle model-risk framework; current April 2026 version
UK Bank plcApplicable sourceREG-EU-001
ECB Guide to Internal ModelsInternal-model supervisory expectations for directly supervised EU institutions
Europe S.A.Applicable sourceREG-US-001
Federal Reserve SR 26-2 — Revised Guidance on Model Risk Management2026 interagency model-risk guidance replacing SR 11-7 for relevant US banking organisations
Americas N.A.Applicable sourceREG-PRU-001
Prudential model requirements librarySynthetic mapping of Basel / PRA Rulebook / CRR requirements for IRB, market and counterparty-credit models where applicable
Prudential RiskMapped source setREG-MAP-001
Regulation → internal obligation mappingClause-level mapping from external authority to policy, standard, control and evidence expectation
Group Model RiskStructured mapping03
GOVERNANCE & THREE LINES
Who owns, challenges and assures
Accountability is stored separately from the documents themselves so ownership can be tested across the model lifecycle.
1ST LINEBusiness & Model Owners
Model development, use, performance monitoring, data quality, implementation, limitations and remediation.
Example: Wholesale Credit Risk Modelling2ND LINEGroup Model Risk & Independent Validation
Framework ownership, risk appetite, classification, independent validation, challenge, aggregation and oversight.
Example: Group Model Risk Management3RD LINEGroup Internal Audit
Independent assurance over the design and effectiveness of the model-risk framework and the operation of first- and second-line controls.
Example: Model Risk AuditIDGovernance artefactOwnerState
GOV-001
Model Risk Management FrameworkEnterprise framework, risk appetite, governance structure and lifecycle responsibilities
Group CROSynthetic artefactGOV-002
Model Risk Committee Terms of ReferenceMembership, decision rights, escalation thresholds and reporting responsibilities
Committee ChairSynthetic artefactGOV-003
Model approval authority matrixApproval rights by model tier, model type, legal entity and material change category
Group Model RiskSynthetic artefactGOV-004
RACI — model lifecycleDeveloper, owner, validator, approver, monitor, user, risk steward and auditor responsibilities
Group Model RiskSynthetic artefact04
POLICIES & PROCEDURES
Internal rulebook
The hierarchy shows where each requirement sits and who owns it.
IDPolicy / procedureOwnerState
POL-MRM-001
Group Model Risk Management PolicyClassification, lifecycle governance, validation, monitoring, change, limitations and exceptions
Group Head of Model RiskSynthetic artefactSTD-MRM-001
Model Development StandardMinimum development, documentation, data, testing and implementation requirements
Model Risk MethodologySynthetic artefactSTD-MRM-002
Independent Validation StandardValidation scope, effective challenge, independence, rating and approval requirements
Head of ValidationSynthetic artefactPRO-MRM-001
Model Change & Annual Review ProcedureMateriality assessment, change classification, annual review and approval workflow
Group Model RiskSynthetic artefactPRO-MRM-002
Model Limitation & Exception ProcedureIssue recording, compensating controls, approvals, expiry and escalation
Model Risk OversightSynthetic artefactPRO-MRM-003
Model Inventory ProcedureIdentification, onboarding, tiering, legal-entity scope, dependencies and decommissioning
Model Inventory OfficeSynthetic artefactWEB-MRM-001
Model Risk intranet guidanceUser-facing guidance, FAQs, templates, approval routes and minimum evidence expectations
Group Model RiskSynthetic artefact05
RISK & CONTROL MATRIX · RCSA
Risks, controls & testing evidence
Controls are linked to both the risk they mitigate and the policy or regulatory obligation they implement.
RISK MRM-R01Use of an inadequately validated material model
Potential for incorrect or poorly understood model output to influence material decisions.
→
CONTROL MRM-C12Independent validation before material use
Material models require independent validation and approval before initial production use or material change.
→
EVIDENCEValidation report + approval record
Signed validation conclusion, issue log, committee decision and model-inventory status.
IDRCSA / control artefactOwnerState
RCSA-MRM-001
Model Risk RCSARisk taxonomy, inherent risk, controls, residual risk, issues and action ownership
Group Model RiskSynthetic artefactCTRL-MRM-001
Model inventory completeness controlPeriodic reconciliation of known model-use cases to the approved inventory
1LoD Model OwnerSynthetic artefactCTRL-MRM-012
Independent validation before material usePreventive approval control for new and materially changed models
Independent ValidationSynthetic artefactCTRL-MRM-021
Model performance monitoring reviewPeriodic review of thresholds, breaches, limitations and action escalation
Model OwnerSynthetic artefactCTRL-MRM-034
Model limitation ageing & escalationDetective control over overdue or repeatedly extended model limitations
2LoD Model RiskSynthetic artefact06
REGULATORY CORRESPONDENCE
Letters, feedback & remediation history
Synthetic supervisory records create the history needed to test whether current evidence resolves past concerns.
IDSupervisory recordOwnerState
SUP-2024-01
PRA thematic feedback — model inventory completenessSynthetic supervisory observation on inconsistent identification of non-prudential models
UK Regulatory AffairsSynthetic artefactSUP-2025-03
ECB feedback — validation independenceSynthetic finding concerning resourcing, challenge documentation and closure evidence
EU Regulatory AffairsSynthetic artefactSUP-2026-02
US supervisory feedback — model change governanceSynthetic observation on inconsistent materiality assessment for model changes
US Regulatory AffairsSynthetic artefactREM-001
Model Risk remediation programmeCross-jurisdiction remediation plan, milestones, accountable executives and evidence of closure
Group CROSynthetic artefactREM-002
Supervisory commitment trackerCommitments, due dates, regulator, entity, evidence owner and closure status
Regulatory AffairsSynthetic artefact07
ASSURANCE & INTERNAL AUDIT
Independent review across the three lines
Assurance records are kept alongside—but distinct from—the evidence being reviewed.
IDAssurance artefactOwnerState
2LOD-2026-01
Annual Model Risk Framework effectiveness assessmentSecond-line assessment of framework implementation, key metrics, weaknesses and emerging risk
Group Model RiskSynthetic artefactVAL-IRB-042
IRB model independent validation reportConceptual soundness, data, implementation, performance, use, limitations and conclusion
Independent ValidationSynthetic artefactIA-2025-07
Internal Audit — Model Risk GovernanceSynthetic audit covering governance, inventory, validation, monitoring, limitations and regulatory remediation
Group Internal AuditSynthetic artefactIA-2026-02
Internal Audit — Regulatory Model Change GovernanceSynthetic audit of change classification, validation triggers, approvals and evidence lineage
Group Internal AuditSynthetic artefactASS-ISS-001
Integrated assurance issue logSecond-line, validation, audit and supervisory issues with common taxonomy and independent ownership
Group CROSynthetic artefact08
EVIDENCE & OWNERSHIP
What proves the control actually operated
Evidence is not treated as a folder of attachments. It is indexed to the relevant control, period, owner, population and decision.
IDEvidence setOwnerState
EVD-INV-001
Model inventory extractApproved population, model tier, use, entity, owner, validation date, status and dependencies
Model Inventory OfficeSynthetic artefactEVD-COM-001
Model Approval Committee minutes & decisionsChallenge, approvals, conditions, recusals, escalation and action tracking
Committee SecretariatSynthetic artefactEVD-MON-001
Quarterly model performance monitoring packThresholds, breaches, overrides, drift, limitations and management actions
Model OwnerSynthetic artefactEVD-ISS-001
Model limitation registerIssue severity, compensating controls, owner, due date, extensions and closure evidence
Group Model RiskSynthetic artefactEVD-VAL-001
Validation evidence bundleTesting outputs, challenger analysis, implementation checks, issue closure and approval trail
Independent ValidationSynthetic artefactOwnership ruleEvery artefact should answer: who owns it, which entity it applies to, what requirement it supports, which control it evidences, what period it covers, and who independently reviewed it.