A bank with $60 billion in total assets is onboarding a new ML-based credit scoring model. The Chief Risk Officer cites SR 26-2 (which superseded SR 11-7 in April 2026) and instructs the team to complete a formal model validation before deployment. According to SR 26-2, which of the following statements BEST describes the components of model validation?
Select an answer to reveal the explanation.
Short Explanation
Think of validation as a three-legged stool: is the design sound, do the predictions match what actually happened, and is the model still working as conditions change? SR 26-2 keeps those three legs from SR 11-7, and you want someone objective enough to push back doing the checking, not the folks who built the thing.
Full Explanation
SR 26-2, issued on April 17, 2026 by the Federal Reserve, OCC and FDIC, superseded SR 11-7 and is expected to be most relevant to banking organizations with over $30 billion in total assets, which covers this bank. It names three components of model validation: conceptual soundness, outcomes analysis and ongoing model monitoring. Conceptual soundness assesses design, key modeling choices, assumptions and data selection; for an ML model, interpretability measures or benchmarking to other models may be more practical than a purely theoretical review. Outcomes analysis compares model outputs with real-world results, for example back-testing predicted defaults against loan vintages. Ongoing monitoring checks whether the model still performs as expected as products, clients, data or markets change. Effective challenge ties it together: critical analysis by objective experts with the expertise, sufficient independence and organizational standing to force change. The accuracy, data quality and capital adequacy list fails because those are not the named components, and validation is not tied to stress testing. The AUC threshold fails because the guidance sets no numeric performance floors; each bank sets thresholds for its own models. The capital-only scope fails because traditional statistical models and non-generative, non-agentic AI, including ML credit scoring, are in scope; only generative and agentic AI are excluded. Exam caveat: SR 26-2 is non-binding guidance, so non-compliance alone does not bring supervisory criticism, although unsafe practices still can. In practice, confirm the validation report covers all three components and names who provided the effective challenge.