The new interagency model risk management guidance, SR 26-02, changes the regulatory landscape in ways that are still being absorbed across the industry. The headline shift is a narrower, more risk-proportionate definition of what qualifies as a "model." That sounds like a simplification. In practice, it creates a significant governance gap. When the formal model boundary narrows, a large category of risk-bearing tools falls outside it. Spreadsheets, end-user computing asse
