Bank Model Risk Gap Check

You are my model risk desk under the new SR 26-2 guidance, acting as four people on every answer: a model validation lead, a Fed examiner, a chief risk officer, and a third-party risk lead.

Ask me and wait:
1. What am I running? (A) full SR 26-2 readiness across the inventory (B) one model or model family (C) the vendor and third-party models (D) a quarterly validation refresh
2. Where is the data? (A) I upload the model inventory, validation reports, and governance policy (B) I paste the inventory (C) the Claude add-in for Excel on the inventory workbook
3. Context: institution size and complexity, number of models, and which are high risk or regulated-decision models?

Confirm the setup, then wait for my files. On every answer: cite the SR 26-2 expectation, the model or control it applies to, and the gap. Flag anything you cannot tie to my data. End with: "First pass readiness review, not a filing. A named risk officer signs."

Using the data from prompt 01, map every model to the SR 26-2 expectations: governance, development standards, validation, ongoing monitoring, and use. For each model, mark which expectations are met, partial, or missing. Scale the rigor to the model's risk and complexity, as the rule now allows. Output the coverage matrix. First pass only; a named risk officer signs.

SR 26-2 pushes risk controls to day one of the model lifecycle. Find where my current process bolts controls on late instead of at the start: requirements, data quality, development review, and pre-deployment validation. List each gap, the lifecycle stage it belongs in, and the control to add. First pass only; a named human owns the fix.

Re-grade every model to its risk tier under the new profile-based approach. Flag models that were under-tiered (too little oversight for their risk) and over-tiered (wasted effort on low-risk models). Give the recommended tier, the reason, and the oversight each tier now requires. First pass only; a named human confirms.

List every vendor, third-party, and embedded model you can find in my data, including the ones outside the formal inventory. For each: the owner, the validation status, the data it touches, and the nth-party exposure (the vendor's own models). Flag the ones with no validation and no owner. First pass only; a named human owns third-party risk.

Independently re-derive the gap list WITHOUT reusing your earlier work. Re-read the inventory and the SR 26-2 expectations fresh, and list the missing and partial controls again. Compare to prompts 02 and 03. If the two passes disagree on any material gap, output "GATE: FAILED" with the discrepancy and reconcile it before continuing. If they agree, output "GATE: PASSED" and the confirmed gap list. Show the re-derivation.

Only if prompt 06 returned GATE: PASSED. Build the remediation plan: each gap, the SR 26-2 expectation it closes, the owner, the effort, and the priority by risk. Sequence the high-risk and regulated-decision models first. Output the plan as a table a CRO can take to the committee. First pass only; a named risk officer signs.

Assemble the examiner-ready summary: the inventory coverage, the open gaps, the remediation plan with dates and owners, and the governance structure that owns model risk. Write it so an examiner can see the institution knows its gaps and is closing them. First pass only; legal and risk own the final file.