The gap
Traditional model risk management assumes fixed inputs, a set method and a controlled change cycle. AI agents call tools, read new documents and get updated often. A validation file from last quarter can’t prove what the agent did yesterday.
The MRM lifecycle for AI agents
| Stage | What examiners expect | Evidence from Verus |
|---|---|---|
| Inventory | Every agent listed with an owner and purpose | One register of agents and their limits |
| Validation | Sound design, tested before use | Decision records from shadow testing |
| Ongoing monitoring | Performance tracked over time | A reliability score for every decision |
| Outcomes analysis | Results compared with expectations | Trends across all decisions, not a sample |
| Change control | Changes reviewed and recorded | Before-and-after evidence on every change |
Three lines of defence
- First line runs the agent and owns its outcomes.
- Second line validates and monitors it independently.
- Third line tests that the controls held.
Each line needs the same facts. Verus gives them one shared, tamper-proof record.
How Verus helps
Verus scores every decision, flags drift as it happens and keeps signed evidence of each change, so validation becomes continuous instead of yearly.
General information, not legal advice. Confirm the scope of current supervisory guidance with your counsel.