Model Risk Validation
What to expect from an independent model validation engagement, and how to verify it's real effective challenge.
Model risk validation is the independent testing of a specific model's conceptual soundness, ongoing performance, and outcomes, performed by staff or a third-party firm genuinely separate from that model's development. It is the 'effective challenge' function required under SR 26-2 and SR 11-7, distinct from broader model risk management program design.
Real US search demand (Ahrefs): ~60 searches/mo for "model risk validation" · ~$2.50 CPC.
The buyer problem
SR 26-2 (like SR 11-7 before it) requires that models be independently validated, meaning validation must be genuinely separate from the team that built or owns the model, with the standing and technical competence to identify real problems. Institutions without enough internal quantitative staff to validate every tiered model in-house need an outside validator, but the market includes everyone from Big 4 practices to boutique quant shops to actuarial firms, and buyers often cannot tell whether a proposed engagement is real independent testing or a rubber-stamp review dressed up as one.
What a model risk validation engagement covers
A model validation engagement independently tests a specific model (or set of models) across three core techniques: conceptual soundness review (is the model's design, theory, and data appropriate for its use), outcomes analysis and backtesting (does the model's output match real subsequent results), and benchmarking (how does the model compare against alternative or challenger models). The validator produces a written validation report documenting findings, limitations, and any required remediation, which becomes part of the model's permanent documentation and is what examiners review during an exam.
Methods and techniques
- Conceptual soundness review of model theory, design, and data
- Outcomes analysis and backtesting against actual results
- Benchmarking against challenger or alternative models
- Sensitivity analysis on key model assumptions and inputs
- Use-test review confirming the model is used as validated
- Written validation report with findings and remediation requirements
What to verify before you retain
- Genuine independence. Confirm the validation team has no role in the model's development, and ideally no financial incentive tied to the model's continued approval.
- Technical depth matches model complexity. A validator reviewing a complex market-risk or credit model needs quantitative staff who can actually replicate or stress-test the methodology, not just review documentation at a high level.
- Validation cadence aligns to SR 26-2's risk-based approach. Ask how the firm determines validation frequency and depth for your model's tier, materiality, and rate of change, rather than defaulting to a blanket annual schedule.
- Report is exam-ready. Ask to see a redacted sample validation report; it should document methodology, findings, and any limitations clearly enough for an examiner to follow.
- Remediation follow-through. Confirm whether the firm re-tests remediated issues or considers its job done once findings are reported.
Questions to put in your RFP
- Walk us through your conceptual soundness review methodology for a model like ours.
- How do you handle benchmarking when a true challenger model doesn't already exist?
- What does your validation report look like, and can we see a redacted sample?
- How do you determine validation depth and frequency for a given model tier under a risk-based approach?
- What is your team's quantitative background relative to our model's methodology (e.g. logistic regression, machine learning, Monte Carlo simulation)?
- Do you re-test remediated findings, or is validation considered complete once the report is issued?
Skip the cold search. Send this scope to us and we route it toward qualified model risk validation firms.
Request firmsRed flags
- A firm that also built or maintains the model being validated, with no clear independence barrier.
- A validation report template that reads as boilerplate with minimal model-specific detail.
- No willingness to explain their benchmarking approach when no obvious challenger model exists.
- Validation staff without demonstrable quantitative background matching your model's methodology.
- Pressure to complete validation faster than the model's complexity reasonably allows.
Frameworks referenced
Named regulatory guidance relevant to this category. Listed for context; they do not endorse this index or any vendor. Verify any framework alignment claim directly against the issuing body.
- SR 26-2
- SR 26-2 / OCC Bulletin 2026-13: Revised Guidance on Model Risk Management. SR 26-2 (issued by the Federal Reserve as a Supervisory Letter, and simultaneously as OCC Bulletin 2026-13 and an FDIC Financial Institution Letter) reflects fifteen years of supervisory experience since SR 11-7 and updates model risk management expectations for a risk-based, tailored era. It is expected to be most relevant to banking organizations with over $30 billion in total assets. The guidance retains the three foundational pillars, model development and use, validation and ongoing monitoring, and governance and controls, while replacing SR 11-7's de facto annual review cycle with revalidation frequency tied to model materiality, change velocity, and data availability, and expanding attention to vendor and third-party models. Read more →
- SR 11-7
- SR 11-7: Guidance on Model Risk Management. Issued April 4, 2011 jointly with the OCC (as Bulletin 2011-12), SR 11-7 set out supervisory expectations for how banks should manage the risk that quantitative models produce incorrect or misused results. It organized model risk management around three pillars: model development, implementation, and use; model validation; and governance, policies, and controls, and introduced 'effective challenge' as the guiding principle for meaningful independent review. Read more →
- PRA SS1/23
- PRA SS1/23: Model Risk Management Principles for Banks. SS1/23 applies to UK-incorporated banks, building societies, and PRA-designated investment firms that have internal model approval to calculate regulatory capital requirements under Internal Ratings Based (credit risk), Internal Model Approach (market risk), or Internal Model Method (counterparty credit risk) approaches. It sets out five principles the PRA expects firms to embed as a strategic model risk discipline in its own right, comparable in spirit to SR 11-7/SR 26-2 but issued independently by the UK's prudential regulator. Read more →
- ECB Guide
- ECB Guide to Internal Models. The Guide explains how the ECB interprets applicable EU and national law on internal models, creating a level playing field across significant institutions directly supervised by European banking supervision. It was originally developed through TRIM, a large-scale project (2016-2021) combining detailed methodological work with roughly 200 on-site internal model investigations at 65 institutions, and covers credit risk, market risk, and counterparty credit risk models along with general model governance topics. Read more →
Notable model risk validation vendors
Real, publicly-documented vendors active in this category. Sourced and verified; not a ranking or endorsement.
Model Risk Validation: buyer FAQ
How is model validation different from an MRM framework engagement?
Model validation independently tests a specific model. An MRM framework engagement designs or audits the overall governance structure, policy, and tiering system that determines when and how validation happens. See the separate model risk management framework guide for that broader service.
Can our internal audit team perform model validation?
Internal audit typically serves as the third line, independently assessing whether the overall MRM program works, not performing hands-on model validation itself. Validation is usually a second-line function, either an internal MRM/validation team or an independent outside firm.
How much does independent model validation typically cost?
Pricing varies widely by model complexity and firm; most firms in this space price per engagement or per model rather than publishing standard rates. Ask for a scoped quote based on your specific model's complexity and tier.