SR 11–7 Meets OECD: What Credit Risk Governance Actually Looks Like
Two Institutions, One Framework: How SR 11–7 and OECD Principles Work in Practice
Governance frameworks sound abstract until you actually have to implement them.
I know this first hand. I built ML models at credit unions of varying sizes. Whether they made it into production or they lived in presentations, there was always talk of building production-ready models that would run every month, make real decisions, affect real lending. However there was never talk of model risk management. No one ever stopped to ask — including myself — Who validates this thing? Who monitors it? When does it need to be retrained? What happens when it drifts? What happens when it breaks?
I had absolutely no concept of what that actually required from a governance perspective. Looking back, though, I wasn’t alone in not knowing. The analysts building the models didn’t know. The executives approving them didn’t know. Nobody in the organization had connected the dots between “we built a credit model” and “we now own model risk.”
This is when we should have started discussing SR 11–7. This is the conversation we should have been having.
Understanding SR 11–7 and OECD Principles
SR 11–7 is guidance from the Federal Reserve on model risk management. It’s been around since 2011 — it actually predates AI entirely. Its original purpose to provide guidance n credit risk scoring models, but it has since been adopted as the regulatory framework that governs how financial institutions manage model risk. It says three things have to happen:
- The business unit that uses the model has to monitor it.
- An independent function has to validate it.
- An audit has to review whether the first two are actually doing their jobs.
This is a clear three lines of defense. Simple structure. Applies to every model whether it’s a credit scoring model from 2015 or a large language model you’re using for document processing today.
The OECD Principles are different. They’re not regulatory requirements. They’re global standards for responsible AI. They’re guiding principles. They’re aspirational. They ask questions like: Can people understand how this model makes decisions? Is it fair? Who’s accountable when something goes wrong? They’re broader than SR 11–7. They think about society, not just financial risk.
But here’s the thing — they’re not in conflict. OECD principles are actually what responsible implementation of SR 11–7 looks like. It’s a regulatory framework guided by a shared set of principles. SR 11–7 tells you what to do and OECD reminds you why it matters.
Let’s Talk Underwriting Models
Every institution is performing their underwriting differently. Some of it is in-house, some of it is automated. Some institutions have a little of both. The key consideration is often speed — how can the institution make that decision fast? Approve, decline, or counter — all while the member is sitting there. However, the decision also has to be accurate, consistent, and defensible.
So, how do you get to this dream state?
Basically, you build — or you buy — an underwriting model. It looks at debt-to-income ratio, payment history, credit utilization, length of credit history, and a whole host of other factors. Likely, more factors then your loan underwriters could process. It’s a complex box of machine learning that produces a score or a probability of default. The underwriter uses that output to inform the approval decision. Simple enough.
Except now you own a model. And that model is influencing decisions that affect your members and your capital. You know what else it affects? Your regulatory standing. Every single day.
Now here’s where institutions diverge. Some build that model in-house leveraging a data science team, historical loan data and deploy via a production pipeline. Others buy it from a vendor solution as a third party scoring tool to plug in and go.
Get Ian Moore’s stories in your inbox
Join Medium for free to get updates from this writer.
Different paths. Same goal. Same accountability.
Scenario 1: You Built It. You Own It.
Let’s say you’re a larger institution with a data science team. You’ve built an underwriting model in-house using historical loan data. It’s in production. It runs every day. It’s influencing approval decisions across your portfolio.
What is your operating manual? It’s not your documentation and its not your readme. Those are support documents. It’s SR 11–7 — supervisory guidance from the Federal Reserve that sets the standard for how regulated financial institutions must manage model risk. This is not optional. This is not aspirational. This framework is required.
Your first line is the people closest to the model every single day. This is your underwriting team — they’re using the output, making the decisions, and catching inconsistencies in real time. This is also your data science team — they built it, they own its technical performance, and they’re responsible for monitoring model drift and flagging when recalibration is needed. And this is your loan operations team — they’re processing decisions downstream and they’ll often be the first to notice when something feels off. SR 11–7 is explicit — the business unit that uses the model owns day-to-day monitoring. A model score is not a decision. It’s an input to a decision. Everyone in that first line needs to understand the difference.
Your governance function is your second line. This is a coalition unit — finance, risk, technical and operation teams. Their job is to ask the harder questions: is this model still performing as validated? Has the borrower population shifted? Does the recalibration schedule still make sense given current conditions? Are we tracking and monitoring any issues? They own the documentation, the validation standards, and the escalation triggers. When something looks wrong they don’t fix it — they flag it and force a decision.
Your internal audit function is your third line. They sample loans. They check for bias. They test whether the first two lines are actually doing what they said they would. They’re not looking at the model. They’re looking at the governance. Is SR 11–7 being followed? Are denial patterns defensible under fair lending standards? Is the documentation current?
Three lines. Real people in each one. Bridging the AI model governance gap.
Scenario 2: You Bought It. You Still Own It.
Let’s say you’re a smaller institution and you don’t have a data science team. Building a model in-house isn’t realistic. So you do what most institutions your size do and buy an underwriting tool from a third party vendor. It plugs into your loan origination system. It scores applications. It runs every day.
Here’s what a lot of institutions get wrong: they think buying the model removes the risk.
It doesn’t. SR 11–7 is explicit. You are responsible for validating and monitoring every model that influences your lending decisions. You are now an AI deployer. That means, you need to know what is happening inside that black box. The risk does not transfer back to the third party developer. Yes, they are now an AI producer. But that doesn’t change your regulatory obligation. All it does is change how you fulfill that obligation from the model management framework.
Your first line looks a little different here but the accountability is identical. Your underwriting team is still the human in the loop. They are using the output daily, tracking consistency, and should know when to override. But now, you should have a vendor relationship manager. Whether that sits in operations or technology, it doesn’t matter. It just needs to be someone who owns the contract, the SLA, and the communication channel with the vendor. They’re the ones who need to know when the model was last recalibrated, what the performance reporting looks like, and what the escalation process is when something goes wrong. And your loan operations team is still downstream. They should be the first to feel it when the model starts behaving differently.
Your governance function still owns independent oversight, except now their job includes vendor management. Are the recalibration schedules documented? Are we comfortable with this recalibration schedule? Is the vendor providing performance reports? What’s the process when the model drifts? What’s the contractual obligation for revalidation? These aren’t technical questions, they’re governance questions for an entire organization. And they need answers before you sign the contract, not after something breaks.
Your internal audit function still samples loans. Still checks for bias. Still tests whether the first two lines are functioning. And now they’re also reviewing the vendor relationship itself. Is the documentation current? Is the institution actually monitoring the vendor or just assuming everything is fine because the tool is running?
Two institutions. Two different paths to the same underwriting model. One regulatory framework governing both. The execution looks different. The accountability is identical.
The Foundation Always Wins
The key takeaway here is this: Whether you built your underwriting model from scratch or plugged in a vendor tool — the moment it influences a lending decision, you own the risk. SR 11–7 doesn’t care how you got here. It cares what you do next.
This all ties back to the OECD principles for trustworthy AI. Transparency — your members deserve to know how decisions that affect them are made, Fairness — your model shouldn’t discriminate, and audit should prove it doesn’t, and Accountability — someone in your organization has to own this. Not eventually. Now.
Most institutions aren’t having this conversation. The analysts are building. The executives are buying. And nobody has connected the dots between “we deployed a model” and “we now own model risk.”
SR 11–7 has been on the books since 2011. The three lines of defense aren’t new. The accountability isn’t new. What’s new is that your underwriting model is now an AI model — and the regulatory expectation hasn’t changed just because the technology did.
Build the governance before you need it. Not after you wish you had.
