Building Model Risk Management for Growth: A View from the $10 Billion Threshold

Working in model risk management for smaller and growing banks has taught one senior risk executive that crossing the $10 billion asset threshold is not simply about size - it represents a complete operational transformation.

Having validated high-risk models across multiple institutions, the executive argued that growth fundamentally changes how banks must approach models, governance, validation, and enterprise risk management itself.

At smaller community banks, model risk programs are often relatively straightforward. Institutions may rely on a limited number of core models focused on asset-liability management, CECL, stress testing, and BSA/AML requirements.

These models are frequently outsourced to consultants, while oversight may sit with a single part-time risk manager supported by basic spreadsheets and relatively informal governance structures.

However, once institutions cross the $10 billion threshold, complexity rises rapidly.

“Suddenly, the models aren’t just simple regulatory checks,” the executive explained. “They become sophisticated engines requiring deeper testing, more assumptions, and specialized skills.”

As banks grow, outsourcing alone becomes insufficient. Validation work becomes more technical, governance structures become more formalized, and internal model risk teams typically expand significantly.

Reporting structures also evolve from simple committee updates into formal subcommittee governance with audit-grade issue tracking and transparency requirements.

At that stage, model risk management shifts from being a narrow compliance requirement into a core strategic risk discipline.

“The goal is not just to validate, but to challenge models effectively,” the executive said.

That challenge increasingly includes building challenger models, benchmarking assumptions against peers, applying sensitivity testing, and developing a much broader understanding of how models interact across the institution.

The executive argued that effective validators gain a uniquely holistic perspective across bank operations, allowing them to become strategic advisors rather than purely operational control functions.

Today, however, the greatest disruption facing model risk management comes from artificial intelligence and robotic process automation.

AI capabilities are increasingly being embedded into traditional banking models and operational systems - often without risk teams fully understanding the implications.

“Vendors are embedding AI features into familiar systems, sometimes without informing model users or risk teams,” the executive warned.

That development is blurring the historical distinction between a “model” and a “tool,” dramatically increasing the volume of systems potentially requiring oversight and validation.