A bank or credit union can use models throughout its business without building a single one. Fraud scoring, anti-money laundering alert ranking and credit decisions may all rely on quantitative methods embedded in vendor products. The institution still needs to understand how those methods influence its decisions and customer outcomes.
Buying the software can limit access to the underlying methodology, but it does not remove the need for oversight. A proportionate approach starts by identifying the models in use, assessing their significance and deciding what evidence is needed to support their continued use.
For a practical guide to connecting risk, controls and evidence across your institution, download Protecht’s Risk in motion eBook.
Understand the current guidance and its scope
Australia has no single model risk standard, but APRA’s prudential framework covers the subject. Under CPS 220, an institution’s risk management policies must cover the validation, approval and use of models that measure components of risk.[1] For authorised deposit-taking institutions (ADIs) that hold or seek approval to use internal ratings-based models, APRA’s practice guide APG 113 goes further. It describes good practice as a model risk policy covering development, validation, implementation and governance, supported by a central model register, change log and issues register.[2]
Neither document sets rules specific to vendor models. APRA’s letter of 30 April 2026 addresses that gap for AI. It is addressed to all APRA-regulated entities, including credit unions and mutual banks, and adds no new requirements. It expects an inventory of AI tools and use cases, clear ownership across the lifecycle, visibility of the supply chain including fourth parties, contracts that provide audit rights and notice of model updates and incidents, and continuous monitoring in place of point-in-time, sample-based assurance. APRA criticised boards for relying on vendor presentations, and says it will take stronger action where AI risk is not managed in proportion to an entity’s size, scale and complexity.[3] Its operational risk standard, CPS 230, applies to the underlying service-provider arrangements.[4]
The letter covers AI rather than every quantitative model. Institutions should therefore establish which vendor models are AI-enabled, and rely on their own model risk policy for the rest.
For vendor models within the applicable framework, the institution needs enough understanding to assess suitability, limitations and performance. That responsibility includes deciding when missing evidence makes a proposed use unacceptable. Third-party oversight and model governance should support the same decision rather than produce separate assessments with conflicting conclusions.
Work with the evidence available
Proprietary methodology and confidential training data can restrict what a vendor discloses. Those limitations should be recorded and assessed. Outcome testing, independent expertise and appropriate restrictions on use can help, but cannot automatically replace all the evidence needed for a material model.
Build an inventory that distinguishes quantitative models from deterministic rules and other tools. For each model, identify the owner, purpose, vendor, version, decisions influenced and materiality. Separately record generative or agentic tools under the governance arrangements that apply to them. Procurement, technology and business owners can help find capabilities that a central risk team would otherwise miss.
Request development documentation, validation results, performance information, relevant bias testing and change records. Assess whether the evidence covers the version and use deployed at your institution. A vendor’s validation can inform your assessment, but does not establish that the model is suitable for your customer population or configuration.
For example, a fraud model tested on a different transaction mix may produce an unsuitable balance between detection and customer disruption. Compare the evidence with your own portfolio and explain any limits on the conclusion. Where data or methodology remains unavailable, document the uncertainty, the compensating controls and the decision-maker accepting the residual risk.
Monitor outcomes against agreed expectations. Approval rates, fraud detection performance, overrides and complaints can reveal changes that aggregate accuracy measures conceal. Assign owners and thresholds, and define the action that follows a breach. Where outcomes emerge slowly, such as credit losses, use appropriate interim indicators alongside longer-term analysis.
A useful monitoring record links the indicator to its source data, threshold, owner and response. If false positives rise, the response may include checking data quality, reviewing a vendor change and assessing staff workload. Those actions should be traceable to the model and business process so that later reviews can determine whether performance improved.
Require notice of material changes and establish a review process proportionate to their consequences. A change to fraud scoring may alter declined transactions, customer contacts and manual-review workloads. Assess those effects before deployment where possible, and compare results with the baseline afterward.
Record overrides and investigate recurring patterns. Frequent overrides may indicate a model limitation, a data-quality problem or inconsistent staff practice. Where users cannot override a result, define an escalation route and a way to contain harm while the issue is reviewed.
Make proportionality a documented decision
Rank models by their purpose, exposure and potential consequences. A model influencing credit access or financial-crime decisions warrants different oversight from a low-risk productivity tool. Document the basis for each tier and review it when use expands. Specialist external support may be needed for material models; proportionality should guide resources without becoming a reason to leave significant risks unassessed.
Proportionality also depends on access to expertise. A small team may coordinate the inventory and monitoring while obtaining independent specialist review for a material model. Define the question that external support must answer, the evidence it can access and how findings will be resolved. Outsourcing the review still leaves the institution responsible for deciding whether use is acceptable.
Connect model oversight with vendor and compliance work
Link the model inventory to vendor records, relevant obligations, monitoring controls and incidents. Validation evidence then informs due diligence, change notices feed the review workflow, and complaints can be considered alongside performance indicators. A connected record makes it easier to see whether an issue affects one model, several models from the same vendor or a shared source of data. The useful management question is whether every consequential model has an owner, evidence supporting its use and a response when performance deteriorates.
Start with a small set of consequential models and make the governance cycle work before widening coverage. Confirm that owners can obtain the required evidence, monitoring produces usable results and escalations lead to decisions. This gives the institution a practical foundation for broader coverage while making any remaining gaps visible to management.
Next steps for your organisation
Vendor model oversight depends on bringing validation evidence, monitoring results and change decisions together. Protecht connects vendor assessments with risks, controls, obligations, incidents and actions, helping teams track evidence gaps, assign follow-up and report material issues alongside the business processes those models support.
Request a Protecht demo to see how connected risk and compliance workflows can support the decisions your institution needs to make.
References
[1] APRA, Prudential Standard CPS 220 Risk Management. https://www.apra.gov.au/standards/cps-220
[2] APRA, Prudential Practice Guide APG 113 Capital Adequacy: Internal Ratings-based Approach to Credit Risk, June 2026. https://www.apra.gov.au/sites/default/files/2026-06/Prudential%20Practice%20Guide%20APG%20113%20Capital%20Adequacy%20Internal%20Ratings-based%20Approach%20to%20Credit%20Risk%20-%20Clean.pdf
[3] APRA, Letter to industry on artificial intelligence (AI), 30 April 2026. https://www.apra.gov.au/news-and-publications/apra-letter-industry-artificial-intelligence-ai
[4] APRA, Prudential Standard CPS 230 Operational Risk Management. https://www.apra.gov.au/standards/cps-230