Classifying a model vs tool for an effective model risk framework