RBI MRM draft · evidence-pack template
Illustrative — populate with your own dataBoard-ready model-risk evidence pack
A working scaffold for the evidence a regulated lender is expected to keep against RBI's June 2026 draft Guidance on Regulatory Principles for Model Risk Management. Seven templates, each line-mapped to the draft.
Lokta does not validate, certify, or independently assess models. This template organises evidence; it does not produce a regulatory grade. Your model validators, internal audit, and board remain the authority. The June 2026 guidance is a draft out for consultation and may change before it is final.
How to use this pack
- Replace every synthetic row with your own assets and records.
- Work top to bottom — the inventory feeds tiering, which drives validation and reporting.
- Score only what you can evidence today. A policy intention is not evidence.
- Keep it live: re-tier at least annually, revalidate on material change, refresh the board summary each cycle.
1 Model & decisioning-asset inventory
Draft paras 6, 7(3), 10, 13(3), 21-24One catalogue of everything that materially shapes a lending decision — models, BRE rules, scorecards, calculators, spreadsheets, AI use cases, prompts, APIs, vendor tools, and co-lending flows. No asset is used unless it is in inventory.
| Asset ID | Name | Type | Intended use | Owner | Risk tier | Status | Last validated |
|---|---|---|---|---|---|---|---|
| MDL-014 | Unsecured PL scorecard | ML model | Approve / decline | Head of Credit Risk | High | Active | 2026-02 |
| BRE-007 | Income-eligibility ruleset | Decision rules | Eligibility gate | Credit Policy | Medium | Active | 2026-01 |
| VND-003 | Bureau score (co-lending) | Third-party | Risk segmentation | Partnerships | High | Active | Vendor-attested |
Also record per asset: developer / provider, validator, approver, upstream & downstream dependencies, and the latest validation, monitoring, and audit observations.
2 Risk-based tiering
Draft paras 17-20, 52Tier every asset by materiality, complexity, consumer impact, explainability, and third-party reliance — and for AI, by autonomy in the decision. The tier drives validation priority, approval authority, monitoring frequency, documentation depth, and continuity planning.
| Tier | Definition | Validation cadence | Approval authority | Monitoring |
|---|---|---|---|---|
| High | Material consumer or capital impact; low explainability or high autonomy | Pre-deployment + annual + on trigger | Risk Management Committee | Monthly |
| Medium | Moderate impact; bounded autonomy | Pre-deployment + on material change | Model Risk / CRO delegate | Quarterly |
| Low | Limited impact; deterministic and explainable | At deployment + periodic review | Model owner + validator | Semi-annual |
3 Ownership & accountability
Draft paras 8-15, 22Separate the roles. The regulated entity stays accountable for outcomes; owner, validator, and approver must not be the same person for material assets, with three-lines-of-defence coverage.
| Asset | Model owner | Developer / provider | Independent validator | Approver | Senior sponsor |
|---|---|---|---|---|---|
| MDL-014 | Head of Credit Risk | In-house DS team | Model Risk (2nd line) | Risk Mgmt Committee | CRO |
| VND-003 | Partnerships lead | Bureau vendor | Model Risk (2nd line) | CRO delegate | CRO |
4 Validation register
Draft paras 29-33, 46(i); approvals & exceptions 12(1), 18(ii), 34-35Independent validation before deployment, after deployment, on material change or trigger, and periodically — including for third-party models. Record approvals and any exception approvals with rationale, conditions, and remediation dates.
| Asset | Type | Date | Next due | Scope & findings | Status | Committee ref |
|---|---|---|---|---|---|---|
| MDL-014 | Periodic | 2026-02 | 2027-02 | Discrimination stable; PSI within threshold | Approved | RMC-2026-02 |
| BRE-007 | Material change | 2026-01 | On change | New income band; one exception, 90-day remediation | Exception | RMC-2026-01 |
5 Third-party & co-lending dependency ledger
Draft paras 45-48, 51, 53Accountability is not outsourced. Map every vendor, bureau, LSP, AI provider, API, and co-lending dependency that influences a decision, with due diligence, audit rights, continuity, and exit terms on record.
| Provider | Dependency | Decision impact | Audit rights | Continuity / exit | Last review |
|---|---|---|---|---|---|
| Bureau X | Score + attributes | High | Contractual | BCP + 90-day exit | 2026-03 |
| Co-lender Y | Shared underwriting model | High | Joint audit clause | Run-off agreed | 2026-02 |
6 AI/ML controls & human oversight
Draft paras 25, 49-63For AI/ML and automated decisions, evidence scope, explainability thresholds, bias/fairness/drift controls, challenge or red-team testing, deployment safeguards, human-in-command, overrides, and a suspension or kill-switch path.
| Use case | Autonomy | Explainability | Bias / drift control | Human-in-command | Override / kill-switch |
|---|---|---|---|---|---|
| PL scorecard | Assistive | Reason codes per decision | Quarterly fairness + PSI | Adjudicator on edge cases | Revert to ruleset |
| Collections prioritiser | Assistive | Feature attributions | Monthly drift watch | Ops review queue | Manual queue fallback |
7 Board / Risk Committee summary
Draft paras 11-14, 33, 37, 46(ii)The one-page docket a Risk Committee can act on. Pull each line from the templates above so the summary is always reconcilable to the evidence.
- Readiness heatmapDimension-by-dimension status, with the gaps ranked.
- High-risk docketEvery high-tier asset, its owner, and validation status.
- Validations dueWhat is overdue, due this quarter, and recently cleared.
- Open exceptionsRationale, conditions, remediation owner, and expiry.
- Third-party & AI exposureMaterial dependencies and their oversight evidence.
- Material changes & incidentsWhat changed, what broke, what was learned.
- Open gapsKnown evidence gaps with owners and target dates.
- Decisions requestedThe specific approvals the committee is being asked for.