CECL model validation is an independent review of the quantitative model that produces the modelled part of the allowance — its design, its inputs, its outputs and its ongoing performance. Asked as one question it usually contains two, because the thing most banks want reviewed is not only the model but the whole loss estimation process around it: the forecast, the reversion, the qualitative overlay, the controls. The first is scoped by the interagency model risk guidance, revised in April 2026; the second is required of every institution by the allowance policy statement whether or not anything in it meets the definition of a model. CECL Allowance Management runs that second half — the close, the factor support, the bridge and the evidence — around the model you already run, and validates nothing: it is a thing a reviewer tests, not a reviewer.
Where a screen is shown below it is a fictional sample bank in the solution, Ashgrove Plains Bank, third quarter 2026. The requirements are quoted from the agencies, linked at each point.
What is CECL model validation, and what is it not?
It is an independent, evidenced opinion on whether a model works for the purpose it is being used for. The revised guidance defines what it is reviewing as a complex quantitative method, system or approach that uses statistical, economic or financial theory to turn input data into quantitative estimates (OCC Bulletin 2026-13, Model Risk Management: Revised Guidance). A discounted cash flow or probability-of-default model fits. So does a vendor's loss-rate engine.
The guidance is equally explicit about what falls outside: simple arithmetic of the kind found in spreadsheets, and deterministic rule-based processes and software with no statistical, economic or financial theory behind them, are not models (OCC Bulletin 2026-13). Read that exclusion carefully before relaxing. It does not say those things need no control; it says the model risk discipline is not the discipline that controls them. A rule that flags a factor whose source is two quarters old is deterministic, and it still has to be specified, approved, versioned and testable — just not by a model validator.
The confusion that costs banks time is the opposite one. An institution that has validated its loss-rate model and files the report has evidence about one input into the estimate. It has nothing yet about the forecast it fed in, the reversion it chose, the overlay that adds a fifth of the number, or the controls that assembled the package. The policy statement requires all of it to be covered, which is why the two reviews are better planned together and scoped apart.
Validating the model against validating the loss estimation process
Model validation: Conceptual soundness, data inputs, implementation, outcomes analysis and ongoing monitoring of the quantitative model.
Validation of the loss estimation process: The whole estimate: segmentation, the forecast and its horizon, the reversion, the qualitative overlay, the individually evaluated loans, and the controls over all of them.
Model validation: Having something that meets the guidance’s definition of a model.
Validation of the loss estimation process: Having an allowance. The policy statement expects validation of the loss estimation process at every institution.
Model validation: A validator independent of model development and use, with the technical expertise to re-perform the work.
Validation of the loss estimation process: A reviewer independent of the credit approval and the estimation process — often internal audit, a second-line reviewer, or an engaged specialist.
Model validation: A validation report with findings, limitations, back-testing and a conclusion on fitness for the ACL use.
Validation of the loss estimation process: Workpapers testing the controls, the support behind each assumption, and whether the estimate was produced the way the policy says.
Model validation: A model validated for a different purpose — stress testing, pricing — and reused for the allowance without being re-validated for it.
Validation of the loss estimation process: The overlay. Most of the judgement is there and it is the part least likely to appear in either report.
What are CECL model validation requirements under the 2026 guidance?
The requirements are risk-based rather than uniform, and that is the headline change. The agencies issued the revised interagency guidance and the accompanying bulletin "to clarify model risk management principles, to set forth a risk-based approach to model risk management, and to rescind prior model risk management guidance and other issuances" (OCC Bulletin 2026-13). In practice that means the depth of validation a model gets should follow the risk it carries: how material its output is, how complex it is, how much the institution relies on it, and what else would catch an error.
For an allowance model, materiality is rarely in doubt — it produces most of a number that drives the provision, capital and the audit opinion — so the risk-based approach tends to argue for depth rather than against it. Where it helps is in sizing the work around it: a simple weighted-average remaining maturity calculation at a small institution does not need the same treatment as a segment-level discounted cash flow engine with a purchased forecast.
One requirement is specific to the allowance and is missed often enough to be worth stating on its own. If a model was built for another purpose and is being reused here, the policy statement says: "When used for multiple purposes within an institution, models should be specifically adjusted and validated for use in ACL loss estimation processes" (Interagency Policy Statement on Allowances for Credit Losses). A stress-testing model repointed at the allowance needs its own validation for that use, not a copy of the one on file.
How often is CECL model validation required?
There is no universal annual rule, and the OCC said so in terms: "The OCC's guidance on model risk management does not, and should not be interpreted to, require community banks to perform annual model validation" (OCC Bulletin 2025-26, Model Risk Management: Clarification for Community Banks). That clarification is worth having in the file, because an annual cycle adopted out of caution is an expensive habit and one that can crowd out the review that would actually have found something.
What replaces a calendar is a trigger list plus continuous evidence. The handbook describes the continuous half: "Sound validation activities are ongoing, and practices such as the back-testing of expected loss results and sensitivity analysis of material assumptions are important tools that can help management confirm the soundness of its ACL methodologies" (Comptroller's Handbook, Allowances for Credit Losses). A bank that back-tests every quarter and runs sensitivity into every committee package has a running record of model performance between formal validations — and a much better idea of when one is due.
What sets the depth and the cadence of a validation, and what the agencies have actually said
| The question | What applies | Where it comes from |
|---|---|---|
| Must a community bank validate annually? | No. The OCC has clarified that its model risk guidance does not require annual validation by community banks. | OCC Bulletin 2025-26, October 2025 |
| How deep should a validation be? | Risk-based: proportionate to the model’s materiality, complexity and the institution’s reliance on it. | OCC Bulletin 2026-13, April 2026 |
| Does a model built for another purpose need its own ACL validation? | Yes — it should be specifically adjusted and validated for use in the loss estimation process. | Interagency Policy Statement on Allowances for Credit Losses |
| What happens between validations? | Ongoing activities: back-testing of expected loss results and sensitivity analysis of material assumptions. | Comptroller’s Handbook, Allowances for Credit Losses |
| Does the overlay have to be reviewed? | The loss estimation process has to be validated. The overlay is part of it even where it is not a model. | Interagency Policy Statement on Allowances for Credit Losses |
| Does outsourcing move the responsibility? | No. Use of third parties does not diminish the board’s and senior management’s responsibility. | Comptroller’s Handbook, Allowances for Credit Losses |
Who can perform a CECL model validation?
Someone who can re-perform the work and who has nothing to lose by finding a problem. The handbook sets both halves: "The validation process should include procedures for review by a party with appropriate knowledge, technical expertise, and experience who is independent of the [bank's] credit approval and ACL estimation processes" (Comptroller's Handbook, Allowances for Credit Losses).
Independence here is specific. It excludes the people who built the model, the people who run the estimate and the people who approve the credits feeding it. It does not require that the validator be external: a sufficiently expert internal model risk function or internal audit team can do it, provided its reporting line does not run through the estimate's owner. For smaller institutions the expertise half is usually the binding constraint, and the honest answer is often a specialist firm — with the understanding that engaging one does not transfer the responsibility.
Can our external auditor validate our CECL model?
Usually not, if that auditor also audits your financial statements. The handbook spells out the consequence: "Engaging the [bank's] external auditor to perform the validation process described in this [excerpt] when the external auditor also conducts the [bank's] independent financial statement audit may impair the auditor's independence under applicable auditor independence standards and prevent the auditor from performing an independent audit of the [bank's] financial statements" (Comptroller's Handbook, Allowances for Credit Losses).
The logic is plain once stated: an auditor who validated the model would, at year end, be auditing their own work. The practical arrangement at most banks is one firm for the audit and a different firm or internal function for the validation, decided early enough that the validation report exists before fieldwork rather than during it. Where the audit firm's affiliate is considered, the independence question has to be answered by the auditor against their own standards, in writing, before the engagement — not assumed because the entities have different letterheads.
Is the qualitative factor overlay part of the model validation?
Often not, under the guidance's own definition — and that is exactly why it needs saying out loud. A schedule of basis-point adjustments applied to modelled rates by segment rarely applies statistical, economic or financial theory to anything; it is a set of judgements with numbers attached. But the overlay is where management judgement concentrates, it can be a fifth of the allowance, and the loss estimation process it belongs to does have to be validated.
So the question to settle at scoping is not whether the overlay is a model but who reviews it and against what. A workable answer has three parts: the methodology for how factors are set and capped is reviewed as part of the process validation; the support behind each factor is tested as evidence, by internal audit and by the external auditor; and the overlay's effect is shown in sensitivity every quarter so that its materiality is never a surprise. In the sample bank the support for all 81 factor cells is checked each quarter against this quarter's data, the model's driver list and the rules in settings — which gives a reviewer something to re-perform rather than a memo to read. The underlying question of which factors belong at all is the nine factors and the support each needs.
In scope or out: what a validator reviews, and what someone else has to
The quantitative model that produces the modelled estimate
Model validation
A quantitative method that turns input data into estimates. Validation of the model, in the sense the model risk guidance uses.
The economic forecast the model consumes
Model validation
An input, and inputs are part of what a validation tests: where the forecast comes from, its vintage, and how it has performed.
The reversion method beyond the forecast period
Model validation
An assumption inside the estimate, and usually the one carrying the most quarters.
The qualitative factor overlay
Process, not model
Rarely a model under the guidance’s own definition, but squarely inside the loss estimation process the policy statement requires be validated — and it is where most of the judgement sits.
The assembly of the package: the bridge, the ratios, the memo, the binder
Reviewed elsewhere
Arithmetic and evidence handling, not a model. Tested as a control, by internal audit or by the external auditor, not by a model validator.
Spreadsheets with no theory underpinning them
Reviewed elsewhere
The revised guidance excludes simple arithmetic calculations and deterministic rule-based processes — which does not mean they are uncontrolled, only that they are controlled some other way.
Is an AI assistant a model under model risk guidance?
The revised guidance answers the scope question directly, and the answer surprises people in both directions: it describes generative and agentic AI models as novel and rapidly evolving, and for that reason places them outside its scope (OCC Bulletin 2026-13).
Out of scope is not the same as out of control, and no vendor should be allowed to use that exclusion as a claim. What it means is that this particular discipline — the model validation framework, with its validation cycles and its three pillars — is not the framework the agencies are pointing at for these tools. The obligations that remain are the ordinary ones: the estimate still has to be supported, the controls over it still have to be designed and tested, the third-party relationship still has to be managed, and the board is still responsible for the outcome.
The useful move for a buyer is to apply the definition yourself, to each piece of what you are being sold, rather than accepting a label. Does this component apply statistical, economic or financial theories to process input data into quantitative estimates? If so, treat it as a model whatever it is called. If it checks a date, compares a factor against a list of drivers the model carries, drafts a paragraph that cites its sources or adds up a bridge, it is not producing an estimate — but it is producing evidence, and evidence has to be testable. Ask to re-perform it on your own last quarter and see whether you get the same answer twice.
What a validation report should contain, section by section
A validation report is read twice: once by the committee that commissioned it, and once, in a year's time, by a reviewer who wants to know what was looked at and what was not. The second reader is the one to write for. Eight sections cover what both need.
The sections a validation report should carry, and the question each answers
- Scope and exclusions, stated up front
What was reviewed, what was not, and why. The overlay, the forecast and the reversion each named explicitly as in or out.
- The use the model is validated for
Validated for the allowance, not for stress testing or pricing. A model reused across purposes needs the allowance use covered on its own.
- Conceptual soundness
Whether the theory fits the portfolio and the segments, with the developmental evidence reviewed rather than summarised.
- Data inputs and their quality
Where each input comes from, how completeness and accuracy were checked, and what happens to loans the data does not cover well.
- Implementation testing
Evidence the code does what the documentation says — re-performance on real balances, not a walkthrough.
- Outcomes analysis and back-testing
How the model has performed against realised losses, at a horizon that makes sense for the portfolio, with the limitations of short histories stated.
- Sensitivity of material assumptions
What moves the answer: the forecast horizon, the reversion, the scenario weights, the overlay. The handbook names back-testing and sensitivity as ongoing validation practices.
- Findings, severity, owners and dates
Each finding rated, assigned and dated, with management’s response recorded — and a clear statement of whether the model is fit for use in the meantime.
The rules a reviewer can re-perform, versioned and approved
What to ask a vendor before you buy, and what you keep responsibility for
Two questions separate most products in this market faster than a feature list. The first is which half of the work it does: does it produce the modelled estimate, or does it run the process around a model you already have? The second is what evidence it leaves behind — because a product that produces a number and no file has moved the work rather than reduced it. The fuller version of that comparison is what CECL software does around the model you already run.
Whatever the answer, the responsibility does not move. The handbook is unambiguous that using a third party leaves the board and senior management responsible for the activity being performed safely and soundly and within the law (Comptroller's Handbook, Allowances for Credit Losses). A vendor validation report is evidence you can use; it is not a validation you have performed, and a reviewer will ask what you did with it.
Where this solution sits is worth saying plainly, including the parts that will not help you. It does not calculate the model estimate and nothing in it validates your CECL model: it reads the model's results by segment and its driver list and builds the close around them. It does not remove the need for an independent review of the overlay — it makes that review cheaper, because the support for every factor cell is current, cited and testable rather than reconstructed. And it does not approve anything: the agents propose, the allowance manager decides, the committee votes, and the Controller books the entry.
What a validator asks to see: every dollar of the change, and nothing absorbed
Eighty-one cells a reviewer can re-perform, with the checks that were run on each
To see the rules, the bridge and the factor evidence a reviewer would ask for, on one quarter, start from CECL Allowance Management.
Questions people ask
Is CECL model validation required by regulation?
Validation of the loss estimation process is expected of every institution by the interagency allowance policy statement, and model risk management guidance applies to anything meeting its definition of a model. Neither is a line-item rule with a fixed frequency; both are risk-based expectations that examiners test, and both leave the depth and cadence to the institution to justify.
Can internal audit perform the validation?
It can, if it has the technical expertise and is independent of the credit approval and estimation processes. The handbook frames the requirement around knowledge, expertise, experience and independence rather than around which department the reviewer sits in. Where internal audit lacks the quantitative expertise, a common arrangement is a specialist validator with internal audit testing the controls around the estimate.
What is the difference between model validation and model monitoring?
Monitoring is what management does continuously — back-testing expected losses against realised ones, running sensitivity on material assumptions, watching for drift in inputs. Validation is a periodic independent opinion that takes that monitoring as evidence and tests it. The handbook describes sound validation activities as ongoing, which is a reminder that the two are meant to feed each other rather than alternate.
Does a vendor model need its own validation?
Yes, and the fact that the vendor supplies a validation report does not discharge it. You still have to understand the model's design, test its inputs against your own portfolio, and satisfy yourself that it works for your segments. The OCC's handbook states that use of third parties does not diminish the board's and senior management's responsibility for the activity.
Does a qualitative factor framework count as a model?
Usually not under the revised guidance's definition, which excludes deterministic rule-based processes and software with no statistical, economic or financial theory underpinning them. It is still part of the loss estimation process that has to be validated, and because it concentrates management judgement it is often the part a reviewer spends the most time on.
Does CECL Allowance Management validate our model?
No. It works around the model you already run, reading its results by segment and its driver list, and it neither calculates nor reviews the model estimate. What it does is make the surrounding process reviewable: deterministic rules with a version history, a current cited source behind every factor cell, a bridge that shows any unexplained difference, and sensitivity run every quarter.