Model Risk Directory emblemModel Risk Directory
Governance

Validation independence

The organizational and practical separation that allows validators to challenge a model without conflicting responsibility or incentive. Independence is supported by reporting lines, authority, funding, access, competence, and conflict controls.

Last updated: Last reviewed by: Model Risk Directory editorial team

How the term is used in model risk management

The organizational and practical separation that allows validators to challenge a model without conflicting responsibility or incentive. Independence is supported by reporting lines, authority, funding, access, competence, and conflict controls. The exact implementation varies by institution, model type, risk rating, and governing framework. Use the linked regulatory pages and buyer guides below for scope-specific requirements.

Related glossary terms

Model validationThree lines of defenseEffective challenge

Guides and frameworks that use this term

GuideModel Risk ValidationModel risk validation is the independent testing of a specific model's conceptual soundness, ongoing performance, and outcomes, performed by staff or a third-party firm genuinely separate from that model's development. It is the 'effective challenge' function required under SR 26-2 and SR 11-7, distinct from broader model risk management program design.GuideTop model risk management firmsThe right model risk management firm depends on the models in scope, governing framework, independence requirements, technical methods, jurisdiction, and delivery capacity. This guide groups the directory's advisory firms alphabetically and provides a verification checklist. It does not assign rankings, scores, or endorsements without comparable evidence.FrameworkSR 26-2SR 26-2, issued jointly by the Federal Reserve, OCC, and FDIC on April 17, 2026, is the current US interagency guidance on model risk management. It supersedes SR 11-7 (2011) and SR 21-8 (2021), preserving core disciplines like effective challenge and independent validation while shifting to a risk-based approach tailored to an institution's model risk profile, size, and complexity.FrameworkPRA SS1/23PRA SS1/23 is the Bank of England Prudential Regulation Authority's supervisory statement setting out five model risk management principles for UK banks with internal model approval for credit, market, or counterparty credit risk. It took effect May 17, 2024 and explicitly extends to risks from AI and machine learning modeling techniques.FrameworkOSFI E-23OSFI E-23 is Canada's enterprise-wide model risk management guideline for federally regulated financial institutions. The final 2025 guideline takes effect on 1 May 2027 and applies a risk-based approach across model identification, inventory, risk ratings, lifecycle governance, independent review, monitoring, third-party models, and decommissioning.FrameworkHKMA CA-G-4HKMA CA-G-4 sets validation expectations for internal-ratings-based credit-risk systems used by authorized institutions. The current 2025 version covers governance, data, model design, quantitative and qualitative validation, use tests, stress testing, overrides, validation frequency, independence, findings, and supervisory review. It is model-specific rather than an enterprise-wide MRM standard.