Model Governance Policy Template
Executive Summary
Key Takeaways
- ✓ A model governance policy needs to be written down; an informal, unwritten policy is not a policy, it is an assumption.
- ✓ The model inventory is the foundation every other section of the policy depends on.
- ✓ Tiering criteria should determine review depth and sign-off authority, not be applied uniformly across every model.
- ✓ Sign-off authority should be assigned by name or role, not left ambiguous.
- ✓ The policy should be scaled to the organisation; a mid market firm does not need a large bank's regulatory infrastructure to have a working policy.
Purpose¶
Financial model governance, described on its own pillar page, only functions as a system if it is written down. An unwritten policy is not a lighter version of governance, it is the absence of governance, dependent entirely on individual memory and habit rather than an explicit, auditable framework.
This template sets out the structure a written model governance policy document should follow, sized for an organisation that needs real governance without the infrastructure of a large regulated bank's model risk function.
Who Should Use This Template¶
- CFOs and finance controllers drafting a governance policy for the first time, or formalising an informal one.
- Boards wanting a benchmark for what a complete policy document should contain before approving one.
- Advisory firms helping clients build or review their model governance framework.
Template Structure¶
- Purpose and Scope — what the policy covers (which models, which decisions) and what it does not.
- Model Inventory Requirements — the fields every model record must capture: owner, purpose, tier, last review date, audit status.
- Tiering Framework — the criteria used to classify models by materiality (high, medium, low), and what each tier requires.
- Review Cadence by Tier — how often each tier must be reviewed, and by whom (internal review versus independent audit).
- Sign-Off Authority — who is authorised to approve a model for use at each tier, and what evidence that approval must be based on.
- Version Control Requirements — the minimum discipline required for recording changes to a model, particularly high tier ones.
- Handover Procedure — how model ownership transfers between individuals or teams without losing institutional knowledge.
- Exception Handling — how deviations from the policy are recorded, approved, and tracked, rather than silently permitted.
- Policy Review Cycle — how often the policy itself is reviewed and by whom.
How to Use It¶
Start with the Model Inventory Requirements and Tiering Framework sections. Everything else in the policy, review cadence, sign-off authority, depends on having a complete inventory and a working tiering framework first. An organisation building governance from nothing should treat inventory and tiering as the minimum viable version of this policy, and add the remaining sections as the framework matures.
Be specific in the Sign-Off Authority section. Naming a role, "the CFO", rather than leaving approval implicit or unassigned, is what makes this section enforceable rather than aspirational.
For organisations in project finance or infrastructure lending, the review cadence for high tier models should reference financial close and refinancing as fixed trigger points, in addition to any calendar based schedule, consistent with the Project Finance Model Audit pillar page.
Common Pitfalls¶
No inventory, policy anyway. A policy that specifies tiering and review cadence without an underlying inventory to apply it to has nothing to act on.
Uniform treatment across tiers. Applying the same review depth to every model regardless of materiality defeats the purpose of tiering and wastes scrutiny on low stakes models.
Ambiguous sign-off authority. If no specific role is named as accountable for approving a model's use, the policy will not be enforced consistently in practice.
A policy nobody reviews. A governance policy is only credible if it is itself reviewed on a defined cycle, not written once and left untouched as the organisation's model risk profile changes.
Continue Reading¶
Related Pillars¶
Related Technical Guides¶
Related Glossary¶
Related Checklists¶
Related Resources¶
Related Products¶
How OXXON tests thisRun a free structural check with FMAE
Frequently Asked Questions
What is a model governance policy?
A written document defining how an organisation manages the risk of relying on financial models, covering the model inventory, how models are tiered, how often they are reviewed, and who has authority to sign off on their use.
Does a small or mid market firm really need a written policy?
Yes, scaled appropriately. A written policy, even a short one, converts an informal, person dependent process into an explicit, auditable one. See the Financial Model Governance pillar page.
What is the difference between the model inventory and the tiering framework?
The inventory is the list of every material model. Tiering is the criteria used to classify each model in that list by how much is at stake if it is wrong. See Model Inventory and Model Tiering.
How is review cadence typically set?
By tier. High tier models typically warrant more frequent, and more independent, review than low tier models, rather than every model being reviewed on the same schedule.
What does sign-off authority mean in this context?
A defined statement of who is authorised to approve a model for use in a decision, and what evidence, including audit status, that approval should be based on.
Should this policy specify when independent audit is required?
Yes. The policy should state which tier of model requires independent, external verification such as a full financial model audit, and which can be managed through internal review alone.
How often should the policy itself be reviewed?
At least annually, and whenever the organisation's model risk profile changes materially, consistent with the guidance on the Financial Model Governance pillar page.
Who typically owns this policy inside an organisation?
This varies, but the role should be explicitly assigned, commonly the CFO or a designated finance controller in mid market firms, and a dedicated model risk function in larger institutions.
References
Related Articles
What Is Model Risk?
Model risk is the risk that a decision is wrong not because the underlying business or investment case was flawed, but because the model used to evaluate it was. It is a distinct category of risk from market risk, credit risk, or operational risk, and it applies to any organisation that relies on a financial model, spreadsheet or otherwise, to support a material decision. Most published model risk content addresses statistical and regulatory capital models used inside banks. This page defines model risk specifically as it applies to Excel based financial models, the kind used every day for investment decisions, lending, and transaction evaluation, which is a related but distinct problem from the quantitative model risk literature most search results return.
What Is Financial Model Governance?
Financial model governance is the set of policies, roles, and controls an organisation puts in place to manage the risk that comes from relying on financial models for material decisions. It is the organisational layer that sits above any individual financial model audit: governance determines when a model gets audited, who owns that decision, how versions are tracked, and what happens to findings once they exist. Most published governance content online is written for large, tier one banks operating under formal regulatory regimes. A private equity firm, a family office, or a mid market corporate finance team rarely has that scale of infrastructure, and does not need it, but still carries real exposure if no governance exists at all. This page defines governance at the level that actually applies to most organisations relying on Excel models, not just the largest ones.