Computer modelling and simulation holds the promise of improved outcomes and more efficient resource allocation. However, attaining these results requires careful consideration of model inputs, robust mechanistic or probabilistic characterizations, delineation of assumptions, validation of outputs versus available data, and the appropriate use of model results. Formalizing these steps is necessary to ensure that checks and balances are implemented transparently and can be audited if necessary. A process has been developed by which a mechanistic corrosion model can be built, validated, and used. The most critical aspect of the process is the validation, by which the model can be tested and shown to be accurate within an acceptable tolerance. Nevertheless, the clear definition of the overall process allows the model to be properly understood, including the necessary context of inputs, assumptions, limitations, and uncertainty. Thus, the process allows the model output to be relied upon for managing risk and maintaining system integrity by both operators and regulators.