The Board Owns It Now

The Examiner’s Question · RBI’s MRMF 2026, read like evidence. By Dr. Anandkumar Prakasam

The Clause

Chapter II is six paragraphs long and rearranges the furniture of accountability. Paragraph 8 makes the regulated entity accountable for the outcomes of all its models, including the ones it bought. Paragraph 9 requires a Board-approved model risk management framework covering every model, AI included. Paragraph 10 lists what the framework must contain, from taxonomy and tiering to exception handling and decommissioning. Paragraph 11 gives the Board itself the duty to approve the framework and a model risk appetite, informed by scenarios and forward looking. Paragraph 12 assigns the Risk Management Committee of the Board (RMCB) a working agenda, high-tier validation reports, deployment approvals, annual tiering review, exceptions, third party models, AI oversight and breach reporting. Paragraph 13 tasks senior management with making all of it operational and reporting upward.

What It Actually Asks

The load-bearing phrase is accountable for outcomes. Not for process, for outcomes. A framework document, however elegant, satisfies paragraph 9 for exactly as long as paragraph 8 stays untested. The real demand is a functioning chain from the model on a server to a committee of the Board, in which information flows upward in a form directors can challenge and authority flows downward in a form engineers can execute. Paragraph 11’s appetite requirement is the sharpest tooth. An appetite statement for model risk forces the Board to say in advance how much model failure it is prepared to carry, which converts every later breach from a surprise into a variance against a stated position. Paragraph 12 then makes the RMCB the place where the appetite meets the evidence, with an agenda too specific to delegate into a slide deck. An examiner reading these six paragraphs will not ask to see the framework first. They will ask for the last four RMCB packs and check whether the committee ever declined anything.

The Incident File

In November 2019 AUSTRAC, Australia’s financial intelligence regulator, filed proceedings against Westpac, one of the country’s four major banks, alleging more than twenty three million breaches of anti money laundering law. The core of the failure was automated. The bank’s systems for international funds transfer reporting had failed for years to report transactions as required, and monitoring had not detected patterns later linked to child exploitation payments, the detail that made the case a national scandal. What matters for this episode is where the consequences landed. Not in the technology function. The chief executive resigned within days. The chairman brought forward his retirement. In September 2020 the bank agreed to a penalty of 1.3 billion Australian dollars, the largest in the country’s corporate history. The systems that failed were plumbing, automated pipelines with reporting obligations attached. The accountability that answered for them was the Board’s. That is the exact geometry paragraphs 8 to 13 draw, and Westpac shows it operating in a jurisdiction that never needed the word AI to enforce it.

The Trap

The framework will be written. That is not in doubt, every institution will have a Board-approved MRMF within months of finalisation, most of them commissioned from the same handful of consultancies and structurally identical. The trap is a framework that governs documents instead of models. Appetite statements written as platitudes that no metric can breach. RMCB agendas where model items arrive as noting papers, pre-decided below, with the committee’s role reduced to receiving assurance. Minutes that record presence, not challenge. An examiner can measure the gap with one number, the count of occasions on which the RMCB modified, deferred or refused a model decision put before it. If that number is zero across a year, the committee is a ceremony, and paragraph 12 exists precisely because ceremonies fail.

The Fix

Give the Board instruments, not summaries. The pattern set is a model risk appetite statement with named metrics and thresholds that senior management reports against, a governance debt heatmap that shows directors where controls lag adoption, and a standing set of board questions that directors can ask without technical fluency, the kind my book builds as an eighteen question toolkit. The RMCB gets a calendar that spreads paragraph 12’s duties across the year rather than compressing them into an annual omnibus, and a management information pack whose headline is variance against appetite, so every meeting starts from the position the Board already took. Accountability for outcomes then has a paper trail that runs in both directions, which is the only defensible posture when the outcome is bad and the inquiry begins.

The Examiner’s Question

Take your last four risk committee packs and count the model decisions the committee actually changed. Zero means the framework is decorative, and when an outcome lands on the Board table under paragraph 8, decorative will be the finding.

Commentary on a draft under consultation, not legal advice. Paragraph numbers may change at finalisation.