Model risk audit

A model risk audit examines a model as a business asset with potential to cause harm. It documents what the model is for, what data trained or grounds it, how it was evaluated, where it fails, who can change it and how it is monitored. The practice originates in banking, where regulators have long required model risk management for credit and market models, and it has extended to LLM-based systems as they entered regulated decisions.

For LLM applications, the audit typically covers the evaluation suite and its results, prompt and model versions, guardrails and policy gates on actions, data-handling controls, logging sufficient to reconstruct any decision, and a defined process for change and rollback. It answers the regulator's question: can you show that this system does what you claim and that you would know if it stopped?

It is not a one-off certification. Models drift, providers update, and prompts change, so the audit is a recurring cycle. It is also distinct from a security penetration test, which looks at the system's attack surface rather than its decision quality.

• Compliance officer: produces the documentation regulators such as the RBI or an internal model-risk committee will ask for before and after deployment.
• CTO / Head of Engineering: forces evaluation, versioning and rollback discipline that improves the system regardless of regulation.
• CFO: quantifies the financial exposure from model errors, which informs how much autonomy the model should be given.
• Founder / CEO: turns "we use AI" from a liability into a defensible, documented position with boards and customers.

Model risk audits exist because models make or influence decisions that affect money, health and rights, and their failures are often silent. A model that is wrong in a consistent way can operate for months before anyone notices. The audit makes the model's behaviour and limits explicit, so the organisation can decide how much to trust it and detect when that trust is no longer warranted. The trade-off is effort: building golden datasets, maintaining eval results per version and keeping decision logs takes engineering time. That cost is small compared with discovering a systematic error through a regulator's enquiry or a customer complaint.

• An NBFC documenting evaluation results, version history and human-override rates for an AI-assisted loan-eligibility screen.
• An insurer auditing a claims-triage agent for consistency across claim types and for cases where it should always defer to a human.
• A hospital reviewing a clinical-summary assistant against clinician-graded samples before extending its use to new departments.
• A SaaS company running quarterly evaluation reviews on its support agent, tied to model and prompt version changes.
• A payments company assessing a fraud model's false-positive impact on customers alongside its detection rate.

Technique / practiceA recurring practice combining evaluation, documentation and governance. Eazyware builds the eval suites, version logs and audit trails that make it possible, aligned with our evals-over-demos stance, and delivers it with Private Agentic AI and ongoing operations.

Eazyware service that covers it: Agentic AI Solutions (self-hosted). Starting prices are on the pricing page.