Modelio - EUC and model register
The most expensive model risk is rarely in the model that was validated for months. It is in the spreadsheet next to it that nobody dares to call a model. Modelio registers that layer: every calculation sheet, model and AI application a decision rests on, declared and signed for by its own owner, graded by risk and demonstrably under control.
The challenge
From blind spot to control
Alongside the officially validated models runs a second layer that appears nowhere: the calculation sheets people use to adjust, supplement and pass on results, which under the broad model definition are in fact models.
Inventory stops at the official models
The Excel correction that adjusts the outcome is not in it, and low-code and GenAI only make that invisible layer grow faster.
One register for every layer
Every calculation sheet, model and AI application a decision rests on gets declared and registered, whatever its origin.
A snapshot that does not keep up
An inventory round starts ageing from day two, and control stays stuck at the level from when the file was still just an aid.
Control grows with importance
Recurring requests keep the register current, and the required control automatically scales with how heavily a decision leans on the artefact.
No owner, no accountability
A department name in a spreadsheet is not ownership, and knowing internally what matters is not the same as being able to show it to a supervisor.
Signed ownership, demonstrable
The owner declares and signs personally, every action enters the audit trail as an attestation, with date and person, ready to show.
This is what it looks like
A selection from Modelio
Click a thumbnail for that screen, or the image itself for the full-size view.
The weighting
The risk level is calculated, not estimated
Modelio calculates the risk level on fixed rules, so two people describing the same file arrive at the same answer.
Spreadsheets, models and AI in one list
A spreadsheet, a calculation model and an AI application sit in the same register and go over the same scale. Keep them apart and you cannot compare them.
Materiality times complexity gives the base score
Both are set to low, medium or high. Multiplied they give a base score from 1 to 9, so a simple file with large consequences does not disappear next to a complex file without them.
The more a decision leans on it, the higher the score
If the artefact only serves insight, nothing changes. If it is a contributing basis for a decision, one point is added. If it is the sole basis, three are.
Four risk levels, from low to critical
From 9 critical, from 6 high, from 3 medium, below that low. The risk level is calculated, not a form field: nobody can talk their own file down.
Three kinds of control, with a hard floor
Uncontrolled, managed and controlled. An artefact that is the sole basis for a decision requires controlled; every other registered artefact at least managed. Anything below that is a gap and shows up as one.
What Modelio offers
The owner declares, the register stays alive
Modelio turns the classic register around. Not a central administrator trying to keep track of what circulates in the organisation, but the manager who declares their own artefacts and signs for them.
Attestation by magic link, no account
Managers receive a personal link by email and enter their artefacts without logging in, without a password and without a licence. That removes the barrier that otherwise strands a request with the very people who have the answer.
Signed ownership
Whoever declares, signs for ownership. Every action on an artefact enters the audit trail as an attestation, with date and person, so it stays traceable who declared what and when.
The risk level follows from the facts
Materiality times complexity gives a base score; how much the decision depends on the artefact escalates it. An artefact that is the sole basis for a decision moves up accordingly, even when it is simple in itself.
Required control grows with it
Every level of dependency carries a minimum level of control. Where actual control sits below it, Modelio marks a gap instead of leaving that judgement to whoever filled in the form.
From validation to remediation
You have the critical artefacts validated, with findings and a sign-off. Every gap gets a remediation plan with steps, an owner and a deadline, in the same environment as the register itself.
AI as a proposal, data in the EU
The built-in AI proposes a classification or a control and summarises a validation; the judgement stays with the human. Your data sits on European servers, stored separately per organisation.
How it works
The process
From an empty list to a signed register in five steps.
Set up a request round
You create a campaign with a message, a depth and a deadline, and add the managers and departments you want to survey.
Send the magic links
Every invitee receives a personal link by email. No account, no password, and you see per department who has already signed.
The manager declares and signs
In the intake the manager lists their spreadsheets, models and AI applications, with purpose, materiality and complexity, and signs for ownership.
Risk level and gap visible
Modelio derives the risk level and places actual control next to required control. The register shows coverage and a heatmap across the portfolio.
Validate and report
The critical artefacts enter the validation flow, with findings and sign-off. Every gap gets a remediation plan with an owner and a deadline.
Who it is for, and in the suite
Two starting points, one register
The problem is the same, the trigger differs. Modelio is the working version of our article on model risk and end-user computing.
Banks and insurers: have to demonstrate under the ECB Guide to internal models or Solvency II that the model landscape is under control, down to the spreadsheets that feed and correct validated models.
Municipalities, semi-public bodies and mid-sized companies: no model risk department needed, yet budgets, tariffs and subsidy decisions rest on calculation sheets nobody administers.
Modelio in the suite
From blind spot to control
Inventory your end-user computing, rank it on materiality times complexity, and control and validate the critical ones as models. That is all there is to it, and no less. Curious how many files feed a decision at your organisation without appearing in any inventory?