Search the practice set
275 questions, 991 terms and 600 topics in 30 areas.
60 results for “Model Risk Management”
Model Inventory
A complete register of models in use with their purpose, owner, risk tier and validation status — the artifact everything else in model governance depends on.
Platform Team Product Model
Running an internal platform team with product management disciplines — users, roadmap, support, metrics — rather than as an infrastructure function.
Assurance Map
A single view of which risks are covered by which assurance activity, exposing both the gaps nobody is looking at and the duplication several parties are paying for.
Prompt Registry
A versioned store of production prompts with their model bindings, parameters and evaluation results, so a prompt change is a reviewable, traceable, reversible deployment.
Standard Change
A pre-authorised class of change whose risk controls are automated and evidenced, so it does not need per-instance approval.
Advisory Review Model
Running architecture review as a consulting service that improves designs rather than as an approval gate that permits them.
Application Portfolio Management
Maintaining an inventory of every application with its owner, cost, business value and technical health, and using it to decide what to invest in, replace or retire.
Architecture Cost Model
A calculation, made during design, of what an architecture will cost to run at expected and at peak volume.
Arrival Rate Model
Driving a load test by requests arriving per second regardless of how the system responds, rather than by a fixed number of virtual users.
C4 Model
A set of four nested diagram levels — context, container, component, code — that keeps each diagram at one consistent level of abstraction.
Capability Model
A structured map of what a business does, independent of how it is organised or which systems support it, used to align technology investment with function.
Consent Management
Capturing, storing, honouring and evidencing a data subject's permissions for specific processing purposes, including withdrawal.
Cost Accountability Model
The arrangement determining whether teams merely see their costs or are financially charged for them, and the behaviour each produces.
Cost Model Sensitivity
Identifying which assumptions in a cost projection dominate the outcome, so effort goes into the estimates that actually matter.
Embedding Model Migration
The process of moving a corpus to a new embedding model, which requires re-embedding everything because vectors from different models are not comparable.
Execution Model Fit
Matching a workload's traffic shape, duration and state requirements to the execution model that suits it, rather than choosing one model for everything.
Focus Management
Deliberately controlling where keyboard focus sits after an interface change, which is what makes a dynamic application usable without a mouse.
Fourth Party Risk
The dependencies of your dependencies, which you did not choose, may not know about, and remain accountable for.
A deployed model performed well in validation and its business metric has declined over four months. Nothing has been deployed. What do you investigate?
The model did not change; its world did Three distinct causes, and they need different responses: Data drift. The input distribution has moved — a new customer
A vendor SaaS product embeds a model that scores customers, and its output drives an automated decision in your process. Your model governance framework covers models you build. What do you do?
The obligation does not transfer with the outsourcing You are accountable for the decision. That the scoring is performed by a vendor changes who operates the m
The business wants to deploy a model that ranks loan applications, with a credit officer making the final decision. What must the architecture provide, and what will you insist on before go-live?
Classify first, because it determines everything else This decides access to credit for individuals. Under any consequence based classification it is high risk:
Your exception register has grown from 12 to 90 waivers in eighteen months and none have been closed. What does this tell you and what do you do?
What it tells you A register that only grows is recording defeat rather than managing deviation. Three things are true and they need separating: Some standards
A CDC pipeline feeding your warehouse falls three hours behind during a source system's batch job, and the source's transaction log retention is 24 hours. What is the risk and what do you change?
The immediate risk Lag consumes the retention window. At three hours behind against a 24 hour retention, you have 21 hours of margin. If the consumer stops enti
A business unit wants an assistant answering questions from 200,000 internal documents. They ask whether to fine-tune a model or use retrieval. How do you decide?
Retrieval, for this requirement, and the reasoning is not about quality Four properties decide it: Freshness. Documents change. Retrieval reflects a change as s
A document collaboration product needs sharing with individuals, teams, and inherited folder permissions. Which authorization model?
The requirement is relationship shaped The questions this product must answer are: is this user a member of a team that has access to a folder that contains thi
A front-end team wants to replace their global state library because "state management is unmanageable". How do you evaluate the request?
Ask what is actually in the store The complaint almost always resolves to one distinction not having been made: server state versus UI state . Server state is d
An internal AI assistant gives confidently wrong answers. The team wants to upgrade to a better model. What do you check first?
Establish whether the model ever saw the right content Log the retrieved chunks alongside each answer, then take the wrong answers and check: was the correct so
Model Risk Management
Inventory, validation, monitoring and challenge for models that make consequential decisions.
Exception & Waiver Management
Time-boxed, owned deviations with a remediation date, rather than permanent silence.
Assurance, Audit & Model Risk
General material on assurance, architectural governance and risk oversight.
AI Risk Tiering
Classifying a use case by potential harm, and the obligations each tier triggers.
Model Documentation
Model cards, intended use, limitations, and the record a regulator will ask for.
Model Evaluation & Red-Teaming
Adversarial testing of a probabilistic system with no fixed expected output.
Risk Appetite
The stated tolerance that tells you which risks you are allowed to accept.
Risk Assessment Methods
Qualitative matrices, FAIR and scenario analysis, and the illusion of a precise score.
Three Lines Model
Ownership, oversight and independent assurance, and where architecture sits in it.
Architecture Compliance Checks
Automating conformance to standards so review effort goes to the genuinely novel.
Audit Evidence
Producing durable, tamper-evident proof as a by-product rather than as a project.
Bias & Fairness Controls
Measuring disparate outcomes, choosing a fairness definition, and living with the trade-off.
Certification Impact on Architecture
What SOC 2 and ISO 27001 actually require of a design, and what they do not.
Change Advisory vs Automated Gates
Replacing a weekly board with evidence a machine produces on every change.
Continuous Controls Monitoring
Testing controls continuously instead of sampling them once a year.
Control Design vs Operation
A control that is well designed and never runs fails exactly like one that is absent.
Design Authority
How an ARB should decide, what it should not review, and how it avoids becoming a queue.
Human-in-the-Loop Design
Meaningful review rather than a rubber stamp, and designing against automation bias.
Security Design Review
Reviewing an architecture for security while changing it is still cheap.
Segregation of Duties
Splitting authority so no single actor can both make and approve a change.
AI Cost Management
Token accounting, routing, caching and the context-window budget.
Application Portfolio Management
Inventory, ownership, cost and health for every application.
Artifact Management
Immutable versioned outputs, promotion between repositories, and retention policy.
C4 Model
Context, container, component and code as four separate diagrams.
Change Management vs CD
Reconciling CAB-era controls with continuous delivery without pretending either away.
Exit & Concentration Risk
Being able to leave a provider, and what the regulator asks when you cannot.
Flaky Test Management
Quarantine, detection, and the trust a suite loses once red stops meaning broken.
Fleet Management
Inventory, health, configuration and grouping across devices you will never see.