Governance
Built for the reviewyour model risk team will run.
When a bank partner, warehouse lender or investor reviews your vendors, model risk guidance sets the questions. Since April 2026 that guidance is SR 26-2, which supersedes SR 11-7. Flightline is built to be reviewed against it.
Findings inform decisions.They don’t make them.
Flightline is a quality control system. It reviews a loan file that has already been underwritten and reports what it finds. It does not originate, price, approve, deny or set terms on any application. Your team decides, and every response is recorded against the finding.
Governed likethe control it is.
Every change that can move a measured result goes around the same loop, and so does every signal from production. Each step is a control in place today.
The control loop. One: a proposed change, whether a rule, a document schema, a prompt or a model; models are pinned and none changes without approval and an evaluation result. Two: the versioned evaluation suite measures each door of the pipeline before merge, against ground-truthed reviews and files seeded with known defects: perception, decision, review, publication, and system-wide properties including identity invariance. Three: the release gate appends the measured values to an append-only ledger stamped with the commit; every measure is paired with a counter-measure, and a gain bought by a regression is blocked. Four: in production, automated monitors watch what reaches customers around the clock, including whether the evaluation gates are still running, and borrower personal information is redacted from logs. Five: an alert is handled under a documented incident process, with severity assigned and root cause recorded, and the fix returns to the evaluation suite as a new proposed change.
The same file,the same findings.
A quality control that found different defects in otherwise identical files, depending on who the borrower is, would introduce fair lending risk into your process. We render the same loan file under different borrower identities and test that our findings don’t move. The legal duty sits with the credit decision; we hold our own findings to the testing bar anyway.
Illustration: one loan file rendered under two different borrower identities, with every credit-relevant number held identical, produces the same findings.
The requirements,and how we map to them.
Where Flightline tests a requirement inside the review, and where it supports the governance your partners apply to you. These are mappings for your review, not certifications.
- Model risk managementSR 26-2 (April 2026), superseding SR 11-7 · OCC and FDIC counterparts
Conceptual soundness, outcomes analysis, ongoing monitoring and change control, set out above, and documentation for your partners’ model and vendor reviews.
- AI governanceNIST AI Risk Management Framework
Mapped across govern, map, measure and manage: model change policy, intended use and scope boundaries, quantitative assurance, and incident response.
- Agency quality controlFannie Mae Selling Guide, Part D1 · Freddie Mac Guide, Chapter 3402 · HUD Handbook 4000.1, Section V · VA · USDA
Prefunding and post-closing review, findings reported to senior management, trends across reviewed loans, and corrective action with a follow-up review.
- Disclosure accuracyTRID, Regulation Z and Regulation X
Tested inside the review: disclosure timing, fee tolerances, high-cost thresholds and rescission, each finding cited to the rule.
- Fair lendingECOA and Regulation B
Adverse action and pricing exception documentation are tested in the review, and our own findings are tested for identity invariance.
- Data integrityHMDA and Regulation C
Reportable fields tested against the documents, including cross-document conflicts in loan purpose and occupancy.
- Privacy and data protectionGLBA Safeguards Rule
Zero-data-retention model endpoints only, personal information controls in code and at runtime, and SOC 2 Type I and Type II reports.
Requirements are cited in findings as they stood on the review date. Which tests apply depends on the program, the property and the transaction.
Ask for the evidence.We expect you to.
Governance documentation, the regulatory mapping and our security attestation are available for your diligence and your partners’ vendor reviews.
Send us a fileyou’ve already closed.
The fastest way to judge Flightline is on a loan your team already knows. We’ll show you what it finds, and you decide whether it holds.