NEOEDGE AIHow to choose E-23 help. Five options, no ranking.
E-23 help comes in five kinds: large consulting firms, specialist model-validation firms, independent advisers, model risk software, and your own staff. You can mix them. The rule to plan around is independence. Whoever builds or documents a model shouldn’t be the one who reviews it, so the review needs a different person or firm.
What do large consulting firms offer?
Some large firms publish E-23 services such as policy and governance design, inventory and reporting, and outsourced model review, including AI models. They fit when you need a full framework and your board wants a known name. The large-firm E-23 pages cited below are framed around insurers, and neither publishes prices.
What do model-validation specialists offer?
Specialist firms do independent review of specific models, with deep quantitative skills. They fit when a few high-rated models need a review your own staff can’t do independently. Ask whether they also build the inventory or only review models. Ask how much of their work has covered vendor and AI models.
What do independent advisers offer?
Small independent advisers do first-line work in one area. They find the AI tools and models in use, test how they perform on real cases, name owners and write documentation a reviewer can use. They fit when you can name the area and the gap and want a fixed scope. They can’t review what they helped build, so you still need an internal or outside reviewer.
What does model risk software do?
Model risk software holds the inventory and runs the workflow, with approvals, findings, review dates and an audit trail. It fits when you have dozens of models and many people editing the record. Software records ratings and reviews. Your people still decide them. Prices are often not published. OSFI doesn’t name a system, and for a small inventory a controlled spreadsheet can be enough to start.
Can we do it in-house?
Yes. OSFI says institutions can use “internal reviewers or objective third parties” for model review. In-house works when you have a steady flow of models and can staff a reviewer who is independent from development. In a small team, that independence is the hard part. The person who built a pricing sheet can’t be the one who reviews it.
Can we mix them?
Yes. Nothing in the guideline rules it out. One sensible split has first-line work done by your staff or an adviser, independent review by an internal reviewer or an outside firm for the highest-rated models, and software added later if the inventory grows. The risk rating of each model decides how much review it needs.
| Option | What it does | Fits when | Watch for |
|---|---|---|---|
| Large consulting firm | Framework, gap assessment, inventory, outsourced review | You need a full framework and a known name | Published E-23 pages framed around insurers; prices not published |
| Validation specialist | Independent review of specific models | A few high-rated models need review | Ask if they build the inventory; check AI and vendor experience |
| Independent adviser | First-line inventory, evidence and owners for one area | You can name one area and one gap | Can’t review its own work; one person’s capacity |
| Model risk software | Holds the inventory, workflow and audit trail | Dozens of models, many editors | Records ratings and reviews; people decide them; prices often not published |
| In-house | Reviews by your own staff | A steady flow of models; you can staff an independent reviewer | Independence in a small team |
What should we ask any provider?
- Will you build or review? The same provider shouldn’t do both for the same model.
- Have you worked with vendor models and AI tools?
- What do we own at the end? Ask for the inventory file and the documents.
- How will you scale the work to our risk ratings?
- Is the fee fixed, or billed by the hour?
Where I fit
I’m one of those independent advisers. I close one gap at a time in one area: an inventory of the AI and models in use, evidence of how each is tested on real cases, and named owners, with documentation your model-risk team can use. The inventory is a fixed fee from CAD 10,000. If your model-risk team can’t use the documentation, I revise it until they can. I don’t do independent validation, so you’d pair my work with an internal or outside reviewer.
More on E-23 and AI
- E-23 for smaller lenders: a plain guide
- E-23 model inventory template
- Validation vs verification under E-23
- OSFI’s AI safety code: what we know so far
Sources
- OSFI, Guideline E-23 Model Risk Management (2027), sections A.3 (proportionality) and D.2 (model review)
- KPMG Canada, “Are you ready for Guideline E-23?” (2025)
- Deloitte Canada, OSFI expanded guidelines
This page describes kinds of providers and doesn’t rank or endorse any firm. It isn’t legal or regulatory advice.