The More Things Change…
This SR 26-2 to SR 11-7 mapping shows the consistency between the revised and original MRM guidance. The purpose of it is to illustrate that for all the change, much remains the same.
The revised Interagency Model Risk Management Guidance (SR 26-2) contains one “should” statement, and that’s in a footnote! SR 11-7 had 179.
So what replaced them?
Twenty-one “sound practice” statements.
“Should” is a verb and tells you what to do. “Sound practice” is principle-based, i.e., “sound” is an adjective. The phrase indicates the goal and leaves the tactic to you. For institutions trying to figure out what is expected, the questions become: what does each “sound practice” statement cover, and how do we meet it?
We Mapped the Statements
We extracted all 179 “should” statements from SR 11-7 and all 22 uses of the word “sound” in SR 26-2. (Note that “sound” is used in SR 11-7, too, but not the phrase “sound practice.”) One of those 22 uses is generic—“sound principles”— and that leaves 21 that describe specific behavioral expectations or practices. We mapped those to the SR 11-7 “should” statements, and it seems like they’re all implicitly there. In effect, it seems that nothing was dropped; the concepts were reorganized and, in many cases, consolidated. (That being said, there is a change in tone, e.g., the use of the “independence” or “independent” drops from eight time to once, and we’ll have more to say about separately.)
So, if the old “should” statements relate to sound practices, then showing no gaps with the old “shoulds” also shows compliance with the vaguer “sound practices.” It’s an easy way to understand the new guidance and then decide if the qualitative differences–like in prioritization–allow cost savings.
What We Found
A few things jumped out:
- Sound governance absorbs ~46 “should” statements. A single sentence in SR 26-2 about sound governance practices covers what SR 11-7 spelled out across board oversight, policies and procedures, roles and responsibilities, internal audit, model inventory, and documentation. Internal audit alone went from 15 specific instructions to two sentences under the governance umbrella.
- Outcomes analysis and ongoing monitoring picks up ~30. SR 11-7’s detailed prescriptions for process verification, benchmarking, back-testing, override analysis, and performance monitoring are now anchored by a single “sound practice” statement about reviewing outcomes analysis.
- Sound development covers ~18. Testing, data quality, methodology documentation, and the judgmental aspects of model construction—all consolidated under “sound model development activities.”
- Vendor models got promoted. SR 11-7 had no “sound” statements about vendor and third-party models—only “shoulds.” SR 26-2 gives vendors their own dedicated “sound practice” statements for the first time, covering understanding, monitoring, and customization.
- Materiality-based tiering is new. SR 26-2 builds the concepts of inherent risk, exposure, and purpose into a materiality framework that didn’t exist as a standalone structure in SR 11-7. This framework anchors the proportionality principle that runs through the entire revised guidance.
- Effective challenge moved from “should” to “sound practice.” One of the most important concepts in model risk management was expressed entirely through “should” language in SR 11-7. SR 26-2 elevates it to a “sound practice” statement.
Why This Matters
If your gap analysis, policies, or validation procedures were built around SR 11-7’s “should” statements, it’s worth knowing how those map to the revised guidance. The shift from “should” to “sound practice” is a change in tone, and knowing how to translate to familiar concepts should help. We’d argue that understanding the linkage means that you won’t necessarily change your policies and procedures–just how they are justified.
Download the Spreadsheet
The mapping spreadsheet is free, and nothing is required, not even an email address. It includes:
- Our mapping—one row per “should”-to-“sound” pairing, sortable and filterable.
- The full text of each SR 26-2 “sound practice” statement with its section reference
- Corresponding SR 11-7 “sound” counterparts where they exist
- The full text of each mapped SR 11-7 “should” statement
- Notes on what changed and why the mapping was made
- The original SR 11-7 gap analysis template with columns for policy, procedures, actions, evidence, gap, and plans (for old time’s sake)
What’s Next
We’re updating our MRM training course to reflect the revised guidance, including the shift from prescriptive to principle-based expectations and the new materiality framework. More on that soon.
If your institution needs help translating the revised guidance into updated governance frameworks, policies, or validation procedures, we’d welcome the conversation.
This analysis was prepared by Spero Risk Associates, LLC. The spreadsheet is provided as a free resource. Please attribute Spero Risk Associates when referencing this work.