Audit

Model Risk Assessment Workbook

An interactive, saveable workbook to assess model risk across lifecycle stages, document controls and explainability needs, score criticality, and capture prioritized mitigation actions for governance and audit evidence.

Interactive Tool

Model Risk Assessment Workbook

Use this structured workbook to assess model risk across the lifecycle, capture key controls and explainability requirements, document data lineage, score criticality, and record prioritized mitigation actions. Save entries as audit evidence, track remediation, and share results with governance reviewers.

Stable name or identifier used in registries or deployment. Required.
Version, tag, or release identifier (e.g., v1.2.0).
Person or team accountable for the model in production.
Organizational area using or sponsoring the model.
Date of this assessment (YYYY-MM-DD).
What decision, process, or user outcome does this model support? Be specific.
Who directly uses outputs (operators, clinicians, customers, agents)?
List key training and inference data sources and owners. Include external vendors where relevant.
Brief description of training data composition, sampling, labels, and known limitations.
Describe the nature and format of outputs (probabilities, decisions, recommendations, text).
Select the best matching type.
Where the model runs for inference.
Select regulations or internal policies potentially applicable. Add others in notes.
Describe how the model could be abused, produce harmful outputs, be manipulated, or create safety issues. Consider adversarial inputs, data poisoning, social misuse, or over-reliance by users.
What level of explanation is required for users, auditors, or regulators? (e.g., feature attribution, local explanations, traceable decision logic).
1 = Very unlikely, 5 = Very likely. Consider frequency and exposure.
1 = Negligible, 5 = Catastrophic (regulatory penalty, serious harm, large financial loss).
Record combined score. Suggested simple formula: Likelihood x Impact (range 1–25). Use this field to capture the computed value for governance. (Calculation may be automated in future integrations.)
Suggested label used by governance to prioritize controls and reviews.
Are role-based access controls and least-privilege enforced for model artifacts and data?
Are inference requests, decision outputs, and access to model artifacts logged and retained per policy?
Is there monitoring for performance drift, data distribution shift, latency, and alerting for anomalies?
Has the model passed defined validation tests (accuracy, fairness checks, scenario testing) before deployment?
How often will the model be re-validated or re-tested?
Is lineage from source through transformations to model inputs documented and accessible?
Are versions of training, validation, and reference datasets stored and retrievable?
Can you roll back to a prior model version safely?
Select protections applied to training or inference data.
List any third-party models, pretrained components, or vendor services and their risk considerations.
Describe actions to reduce likelihood or impact (technical, process, training, monitoring). Be specific and assign owners and timelines where possible.
List the top three mitigation actions in priority order and why they were prioritized.
Governance decision on accepting residual risk after mitigation.
Person who reviewed and approved this assessment.
Date of governance review (YYYY-MM-DD).
Links to model card, lineage diagrams, validation reports, registries, tickets, or other evidence. Include URLs or references.
You can explore this tool now. Sign in or create an account to save your responses and return to them later.
Sign In to Save Create an Account
Make this tool part of your work

Save a personal copy, bring it to your team, or tailor the questions and workflow to fit what you are hungry to improve.

Member customization and team collaboration are coming soon.
Discuss Ask the Librarian

Discussion

Comments and conversation will live here.