Context
Model Risk Management teams faced tight timelines to respond to examiner questions and internal audit
requests. The bottleneck wasn’t analysis—it was producing consistent, defensible documentation:
interpretations, control narratives, limitations, and disclosures.
SR 11-7 posture
Exam readiness
Non-advisory language
Type-III wedge
Start with compliance drafting (safe to approve), then expand into a governance layer across AI and
analytics: consistent policy controls, evidence bundling, defeaters, and audit logs across models and tools.
Land → Expand
Documentation-first
Model-agnostic governance
Boundaries (non-negotiable)
- No financial advice. No client-specific recommendations, allocations, or trade instructions.
- No “approval language.” The system cannot assert that a model, policy, or control is “compliant” or “approved.”
- Draft-only posture. Outputs are proposed language requiring accountable review and sign-off.
- Explicit accountable roles. Every artifact names human owners for interpretation and approval.
- Evidence-first. Any interpretation must link to approved sources (policy, regulation, internal controls).
Operational rule: The system can draft documentation and structured justifications,
but cannot make determinations, approvals, or recommendations.
CRSP architecture (what is governed)
CRSP (Coherent Reflexive Super-Prompt) makes governance auditable: the policy posture, role boundaries,
evidence requirements, defeaters, and release criteria are versioned artifacts. This produces a consistent,
examiner-friendly story: what we allowed the system to do, what we forbade it to do, and why the output is reviewable.
- Context bundle (versioned): exam posture, prohibited advisory language, disclosure templates, safe phrasing patterns.
- Policy layer: allowed artifact types (e.g., control narratives), escalation conditions, and refusal rules.
- Evidence rules: approved source types (SR 11-7 guidance summaries, internal model policy, control catalog, exam findings).
- Defeaters: blocks for investment advice, “compliance guarantees,” or claims not linked to evidence.
- Audit log: immutable record of requests, versions, evidence bundle IDs, and release outcomes.
AER gate: Ask
The request is normalized into a bounded drafting task: artifact type (e.g., exam response),
audience (examiner vs internal audit), required disclosures, and prohibited advice.
{
"ask": {
"domain": "CHASE_MRM",
"task": "Draft examiner-facing response (non-advisory)",
"artifact_type": "exam_response_package",
"audience": "examiner",
"must_include": [
"scope and limitations",
"control ownership (human roles)",
"model boundaries and assumptions",
"validation references (if provided)"
],
"must_not_include": [
"investment advice",
"client-specific recommendations",
"claims of regulatory approval",
"unsupported compliance guarantees"
],
"accountable_roles": [
"Model Risk Owner",
"Compliance Reviewer",
"Legal Reviewer (as needed)"
],
"policy_version": "crsp.chase.mrm.v1"
}
}
AER gate: Evidence
Evidence is gathered only from approved sources (internal policy, control catalogs, validation summaries,
examiner correspondence, and sanctioned regulatory references). Evidence is stored as a bundle and linked
to the draft for traceability.
{
"evidence": {
"bundle_id": "evb_2026_01_24_007",
"sources": [
{"type":"internal_policy","id":"CHASE_MODEL_RISK_POLICY_v5"},
{"type":"control_catalog","id":"CHASE_MRM_CONTROL_LIBRARY_2025Q4"},
{"type":"exam_finding","id":"EXAM_FINDING_2026_01_A12"}
],
"notes": [
"Avoid stating outcomes as guarantees",
"Tie every control claim to a referenced source"
]
}
}
AER gate: Release
The draft is generated with explicit limitations, structured “review hooks,” and disclosure language.
Defeaters block or downgrade release if the output implies advice, approval, or unsupported claims.
{
"release": {
"status": "APPROVE_FOR_REVIEW",
"output_type": "exam_response_package_draft",
"includes": [
"scope, assumptions, and limitations",
"control narrative mapped to control IDs",
"validation and monitoring summary (if provided)",
"non-advisory and non-approval disclosure"
],
"defeaters_checked": [
"no_investment_advice",
"no_compliance_guarantees",
"evidence_linked_claims_only"
],
"review_required_by": [
"Model Risk Owner",
"Compliance Reviewer"
],
"audit": {
"policy_version": "crsp.chase.mrm.v1",
"evidence_bundle_id": "evb_2026_01_24_007",
"timestamp_utc": "2026-01-24T00:00:00Z"
}
}
}