The Spreadsheet That Became a Model

The Examiner’s Question · RBI’s MRMF 2026, read like evidence. By Dr. Anandkumar Prakasam - Paragraphs 1 to 6 and 7(3).

The Clause

The draft Guidance opens by stating the obvious that nobody had put on paper. Regulated entities now depend on models for decisions that matter, and the risk from those models has to be managed as a discipline of its own. Paragraphs 1 to 6 set the frame. The Guidance covers governance, tiering, lifecycle, third party models and AI. It applies in proportion to nature, scale, complexity and materiality. It reaches eleven classes of regulated entities. It sits alongside existing Directions, which prevail on conflict. And it applies to every model regardless of where it came from. Then paragraph 7(3) defines the word model, and the definition is the quiet earthquake. A model is defined by what it is used for, not by what it is built from. The draft itself offers the illustration that a spreadsheet can be a model.

What It Actually Asks

Read 7(3) the way an examiner will read it. The test is decision impact, not technology. If a quantitative method informs or drives a decision that touches customers, capital, pricing or compliance, it is inside the perimeter, whether it runs on a GPU cluster or in a workbook maintained by one analyst since 2014. That single move destroys the most comfortable assumption in the industry, that model risk lives in the data science department. The operational demand hiding inside these opening paragraphs is a census. Before any framework can be proportionate, an institution has to find everything that meets the use-based test, and most of what meets it has never been called a model by the people who run it. The pricing workbook. The vendor score nobody can explain. The eligibility macro. The Guidance does not ask what models you have. It asks what decisions you automate, and works backwards.

The Incident File

In 2012 the United Kingdom’s Department for Transport ran the competition for the InterCity West Coast rail franchise, one of the largest contracts in its portfolio. FirstGroup won it in August. Virgin Trains, the incumbent, challenged the award in court. In October the Department cancelled the entire competition after discovering what it called significant technical flaws in the model it had used to assess the bids. The flaws lived in a spreadsheet-based financial model. The way inflation and passenger growth assumptions were handled misstated the risk buffer bidders were required to post, so the two lead bids had been compared on numbers that were wrong. Three officials were suspended. The Laidlaw Inquiry catalogued the failures in December 2012. Reimbursing the bidders alone cost taxpayers around forty million pounds, before the cost of rerunning the franchise process. No machine learning was involved anywhere. A spreadsheet, used to decide, became the most expensive model in the Department’s history precisely because nobody governed it as one.

The Trap

The predictable compliance failure is a census with a technology filter. An institution will inventory its AI systems, list its statistical models, stamp the file complete, and never look at the thousand workbooks that decide things daily. A second version of the trap is definitional arbitrage, reclassifying borderline methods as tools, calculators or business logic so they fall outside the register. Both moves produce an inventory that is internally consistent and materially false, and both are visible to an examiner in about an hour, because the examiner will not start from the inventory. The examiner will start from a decision, a declined loan, a priced policy, a flagged transaction, and walk backwards asking what produced this. If the walk ends at something that is not in the register, paragraphs 6 and 7(3) have both failed at once.

The Fix

Start from decisions, not from systems. The pattern is a decision inventory, a register of the consequential decision categories the institution automates or informs, with each entry walked backwards to whatever method produces it. Every method discovered on that walk gets the 7(3) test. Does it inform or drive the decision. If yes, it enters the model inventory with an owner, a materiality note and a tier to be assigned. The use-based definition then works for you rather than against you, because coverage is defined by the decision list, which the business already knows, rather than by a technology hunt that never ends. This is the discovery method the opening chapter of my book “Decision Centric AI Governance” builds its whole argument on. Govern decisions, not models, and the perimeter draws itself.

The Examiner’s Question

Name the three highest-materiality spreadsheets in your institution. Not your models, your spreadsheets. If nobody in the room can answer, your inventory was built with a technology filter, and paragraph 7(3) was written for you.

Commentary on a draft under consultation, not legal advice. Paragraph numbers may change at finalisation.