A bank with $50 billion in total assets has deployed a machine learning model to approve or deny consumer credit applications, and its model validation team is conducting an independent review under SR 26-2 (which superseded SR 11-7 in April 2026). Which of the following activities is MOST central to the conceptual soundness component of validation?

SR 26-2, the April 2026 interagency guidance from the Federal Reserve, OCC and FDIC that superseded SR 11-7, lists three validation components: conceptual soundness, outcomes analysis and ongoing monitoring. Validating conceptual soundness means assessing and documenting model design, including key modeling choices, assumptions, qualitative judgments and data selection, along with construction and developmental testing. For a credit model that covers why a gradient-boosted model was chosen over logistic regression, whether the features make economic sense, and whether the training data represents the applicant population. SR 26-2 adds that theory is not the only route: for complex ML models, interpretability measures or benchmarking against other models may be more practical evidence. Confirming the code compiles and unit tests pass is software quality assurance; a model can build cleanly and still be conceptually wrong for its purpose. Encrypted storage and seven-year log retention are data security and records controls, useful for other obligations but not an evaluation of whether the model is sound. A vendor uptime SLA is an operational and contract matter; availability says nothing about design quality, and vendor models still need validating on their merits. Exam caveat: SR 26-2 is non-binding and scales rigor to materiality, so a high-exposure credit decisioning model warrants the deeper review. In practice, check that the validation report documents the design choices, the evidence behind them, and the limitations found.