Summary Every model has limitations. The mark of a mature MRM framework is not the absence of limitations but the explicit documentation and controlled treatment of them.
Documenting limitations Limitations should be recorded at development, updated through the lifecycle, and visible to users and to governance. Buried limitations are effectively undisclosed.
Compensating controls Where limitations affect decisions, compensating controls close the gap: overlays, thresholds, human review, or restrictions on use cases. Each control is itself governed and evidenced.
Overrides Overrides — user or committee decisions that depart from model output — are legitimate risk-management actions. They must be captured, reasoned, aggregated and periodically reviewed for pattern.
Use restrictions Models validated for one use should not be repurposed silently. Approval for extended use requires targeted validation of the new use.
Governance The model risk committee (or equivalent) sees limitations, overlays, override rates and use extensions as standing items — not exception reports.
Limitations Compensating controls do not remove model risk; they redistribute it. Their effectiveness must be tested.
Related expertise See [Model Risk and Validation](/expertise/model-risk).
Frequently asked questions
What should risk leaders know about documenting limitations?
Limitations should be recorded at development, updated through the lifecycle, and visible to users and to governance. Buried limitations are effectively undisclosed.
What should risk leaders know about compensating controls?
Where limitations affect decisions, compensating controls close the gap: overlays, thresholds, human review, or restrictions on use cases. Each control is itself governed and evidenced.
What should risk leaders know about overrides?
Overrides — user or committee decisions that depart from model output — are legitimate risk-management actions. They must be captured, reasoned, aggregated and periodically reviewed for pattern.
What should risk leaders know about use restrictions?
Models validated for one use should not be repurposed silently. Approval for extended use requires targeted validation of the new use.
What should risk leaders know about governance?
The model risk committee (or equivalent) sees limitations, overlays, override rates and use extensions as standing items — not exception reports.