SR 26-2 vs SR 11-7 gap-analysis checklist

Scope and definitionsThe policy uses the SR 26-2 model definition and records decisions for tools outside scope.

Risk-based approachModel risk, purpose, exposure, materiality, complexity, and institutional context drive control intensity.

Model inventoryThe inventory contains enough information to understand individual and aggregate model risk.

Development and usePurpose, intended use, data, assumptions, methods, testing, limitations, and user feedback are documented.

Validation timingValidation generally occurs before first use, with approved compensating controls for justified exceptions.

Validation frequencyTiming and depth respond to model purpose, method, changes, data, materiality, and practical constraints.

Conceptual soundnessValidation assesses design, choices, assumptions, judgments, data selection, construction, and development testing.

Outcomes analysisOutputs are compared with relevant real-world outcomes, thresholds, and model objectives.

Ongoing monitoringMonitoring covers performance, limitations, data relevance, products, exposures, clients, and market conditions.

Governance and rolesPolicies define accountability, conflicts, development, use, validation, monitoring, approval, and escalation.

Internal auditInternal audit evaluates MRM rigor and policy implementation without routinely duplicating validation.

Third-party productsVendor data, parameters, models, limitations, changes, performance, customization, and monitoring are governed.

AI scope decisionTraditional and non-generative AI models are assessed under the definition; generative and agentic AI follow an explicit alternate governance path.

Superseded referencesPolicies, RFPs, training, procedures, and reports no longer present SR 11-7 or OCC 2011-12 as current guidance.