About
Model risk, operational risk, and AI governance - built from the inside.
Joshua Reh is the Founder and Principal of Cijara Group. He brings 15+ years inside the model risk, operational risk, AI governance, and enterprise data management functions at major financial institutions - not reviewing frameworks from the outside, but building and operating the programs regulators and internal risk committees rely on.
As a VP-level Model Risk and Operational Risk Officer at Wells Fargo, Joshua led the governance program overseeing a biannual review of approximately 600 in-use qualitative and quantitative models across the enterprise. He stood up the system of record that housed and classified nearly 18,000 tools as End User Computing Tools (EUCTs) enterprise-wide - a program that required designing the classification taxonomy, implementation workflow, and ongoing governance infrastructure from the ground up. He has led the remediation of Matters Requiring Immediate Attention (MRIAs) at two separate federally regulated financial institutions - the most serious class of supervisory finding issued by federal banking regulators - working directly with risk leadership and examining agencies to close findings on deadline and under scrutiny. He owned hands-on policy and procedure development to enforce alignment with model risk management regulations, and was responsible for distilling new technology Laws, Rules, and Regulations into actionable requirements converted into operational risk controls across the enterprise. Alongside this, he contributed to regulatory reporting and data governance transformation as a consulting resource working alongside Ernst & Young and Deloitte. Earlier, at Bank of America, he supported CFO Group regulatory reporting infrastructure and global liquidity risk management data sourcing; at Goldman Sachs, he worked in risk analytics and data integration within Operations.
His enterprise data management expertise is grounded in the principles of the DAMA-DMBOK framework - spanning data governance, data quality, metadata management, and master data management - applied at scale across complex, multi-system financial environments.
Joshua founded Cijara Group to bring that operator-grade discipline to community banks and small and mid-size businesses in regulated industries - organizations that face the same risk and regulatory expectations as the largest institutions, without the staff to match. His work spans practical AI implementation, software supply-chain security, and AI governance, pairing frontier AI analysis with the judgment to separate real findings from noise and frame them in terms a bank and its regulators understand.
Joshua holds a Master of Investment Management and Financial Analysis (MIMFA) from Creighton University’s Heider College of Business - a rigorous, CFA Institute-affiliated program focused on investment analysis, portfolio management, quantitative methods, and financial risk - and a BS in Finance from SUNY New Paltz. He holds a Lean Six Sigma Green Belt (awarded July 2024) and AWS and Azure AI certifications.
At Cijara, Joshua leads the firm’s AI implementation, security, and governance practice.
Representative experience
- MRIA remediation at two separate federally regulated financial institutions, working directly with risk leadership and examining agencies
- Biannual governance review of ~600 production qualitative and quantitative models (Wells Fargo)
- Enterprise EUCT program - classification taxonomy and system of record for ~18,000 tools (Wells Fargo)
- Model risk management policy and procedure development aligned to federal regulatory standards
- Technology LRR distillation into operational risk controls across the enterprise
- Enterprise data governance aligned to DAMA-DMBOK principles across complex financial environments
- Regulatory reporting and data governance transformation alongside Ernst & Young and Deloitte
- CFO Group regulatory reporting and global liquidity risk management data sourcing (Bank of America)
- AI governance and adoption advisory for small and mid-size businesses

