The European Solvency II Directive makes explicit reference to and reliance upon internal models. Internal models should cover all material risks of the company and should be consistent across all risks. These models should reflect the nature, scale and complexity of the underlying businesses; they should be proportional in sophistication to the materiality of the risks they cover. However, risk management is much more than models. Internal models must be complemented with internal controls.