Worked Assessment Report Example

Scope of Examination

This targeted examination evaluates Commonwealth National Bank's model risk management practices for its AI/ML model portfolio under OCC SR 26-2. The examination covers traditional model risk management (governance, inventory, validation, monitoring, outcomes analysis) and extends to GenAI-specific governance practices including third-party model risk, concentration risk, and explainability.

The institution operates 23 AI/ML models: 12 credit scoring, 4 fraud detection, 3 AML/BSA, and 4 GenAI applications. The 4 GenAI models were added in 2026 and represent the institution's first deployment of large language model technology in production.

Evidence Sources

1. Cryptographic witness evidence (SWT3): 18 SWT3 witness anchors covering 12 procedures across FIN and AI namespaces, assessed via the audit portal over a 92-day examination window.
2. Document review: Model risk management policy (v4.1), model inventory, validation reports (19 of 23 models), governance committee minutes (Q1-Q3 2026), vendor contracts, and risk appetite statement.
3. Interviews: 4 sessions with the Chief Model Risk Officer, Head of Model Validation, Chief Technology Officer, and Chair of the Model Governance Committee. Interview notes on file (ref: CNB-INT-Q3-01 through 04).

Examination Outcome

2 Matters Requiring Attention (MRAs). No Matters Requiring Immediate Attention (MRIAs). Traditional MRM practices are satisfactory. GenAI governance requires attention in two areas: independent validation of GenAI models and vendor concentration risk documentation.

Supervisory Framework

This examination was conducted per OCC examination procedures aligned with SR 26-2 (Model Risk Management for AI/ML), which supersedes SR 11-7 for AI/ML model portfolios. SR 26-2 is explicitly non-binding supervisory guidance. Examination findings are supervisory assessments, not regulatory mandates.

SWT3 Evidence Verification Method

1. Portal verification: All 18 anchors checked via sovereign.tenova.io/verify. All returned VALID.
2. Independent recomputation (5 anchors): Five anchors selected across FIN and AI namespaces, recomputed using OpenSSL 3.x. All matched.

Temporal Scope

The examination window (92 days) covers Q3 2026 operating activity. SWT3 evidence supplements traditional examination artifacts (committee minutes, validation reports, model performance dashboards). Of 12 procedures assessed, 10 had continuous coverage. Two gaps documented below.

Portfolio Context

The examination assessed both traditional ML models (established MRM practices) and GenAI models (newer, with distinct risk characteristics including non-determinism, third-party dependency, and limited explainability). SR 26-2 Section IX specifically addresses generative AI governance, which this examination evaluates.

Examination Outcome: 2 MRAs, 0 MRIAs

Commonwealth National Bank's traditional model risk management practices are satisfactory and well-established. The institution's expansion into GenAI introduces risk categories (non-determinism, vendor concentration, limited validation methodologies) that require governance attention.

The examination team notes that SWT3 supply chain evidence (AI-CHAIN.1) provided quantitative vendor dependency data that surfaced a concentration risk the institution's own risk management had not identified. This demonstrates the value of cryptographic witness evidence as a supplementary examination tool for portfolio-level risk analysis.

MRA-001 and MRA-002 will be communicated to the institution via supervisory letter. Follow-up examination of both matters scheduled for Q1 2027.

SWT3 witness anchors cited in this report follow the format:

Any anchor can be independently verified at sovereign.tenova.io/verify with no account or authentication. The SHA-256 fingerprint formula is published in the SWT3 Protocol Specification.