Model Risk Directory emblemModel Risk Directory
Validation TechniquesIndependent model validation

Model validation

The set of processes and activities intended to verify that a model is performing as intended, in line with its design and business uses, and to identify potential limitations and assumptions. Validation is meant to be performed by staff independent from model development, providing effective challenge.

Last updated: Last reviewed by: Model Risk Directory editorial team

How the term is used in model risk management

The set of processes and activities intended to verify that a model is performing as intended, in line with its design and business uses, and to identify potential limitations and assumptions. Validation is meant to be performed by staff independent from model development, providing effective challenge. The exact implementation varies by institution, model type, risk rating, and governing framework. Use the linked regulatory pages and buyer guides below for scope-specific requirements.

Related glossary terms

Effective challengeConceptual soundnessOutcomes analysis

Guides and frameworks that use this term

GuideModel Risk ValidationModel risk validation is the independent testing of a specific model's conceptual soundness, ongoing performance, and outcomes, performed by staff or a third-party firm genuinely separate from that model's development. It is the 'effective challenge' function required under SR 26-2 and SR 11-7, distinct from broader model risk management program design.GuideTop model risk management firmsThe right model risk management firm depends on the models in scope, governing framework, independence requirements, technical methods, jurisdiction, and delivery capacity. This guide groups the directory's advisory firms alphabetically and provides a verification checklist. It does not assign rankings, scores, or endorsements without comparable evidence.GuideModel Risk Management FrameworkA model risk management framework is the documented set of policies, roles, and processes an institution uses to identify, tier, govern, and validate its models. Under SR 26-2, a sound framework covers model development and use, independent validation, and governance and controls, scaled to the institution's size and model risk profile rather than applied uniformly.FrameworkCPG 230APRA CPG 230 is operational-risk guidance for implementing CPS 230. It is not a standalone Australian MRM standard. It matters to model risk teams when critical operations depend on model platforms, data services, cloud providers, validation vendors, or other material service providers that must be governed, monitored, and supported by continuity plans.FrameworkOCC 2011-12OCC Bulletin 2011-12 was the OCC's companion issuance to the Federal Reserve's SR 11-7, published the same day in April 2011, applying identical model risk management expectations to OCC-supervised national banks and federal savings associations. It was rescinded April 17, 2026 and replaced by OCC Bulletin 2026-13, issued jointly with the Fed and FDIC.FrameworkPRA SS1/23PRA SS1/23 is the Bank of England Prudential Regulation Authority's supervisory statement setting out five model risk management principles for UK banks with internal model approval for credit, market, or counterparty credit risk. It took effect May 17, 2024 and explicitly extends to risks from AI and machine learning modeling techniques.