ALM model validation is the independent check that an institution's asset-liability model is fit for measuring its interest rate risk: that its inputs are complete and tie to the books, its method suits the balance sheet, its assumptions are supported and approved, and its forecasts and assumptions match what actually happened. Since April 17, 2026, the general model risk guidance for banks is SR 26-2, which replaced SR 11-7; but the expectations specific to interest rate risk, including independent review and back-testing of assumptions, come from the 2010 interagency advisory, its 2012 FAQ and the examination manuals, and they apply at every size. Botminds' Interest Rate Risk (IRRBB) Management is built to hand the second line that evidence, including an independent recompute of every changed assumption.
The examples use a fictional sample credit union in the solution, Norrell Federal Credit Union, and its fictional model validation analyst. The rules are quoted from the regulators' texts or summarised with a link where they are not.
Validation rules that still bind, whatever SR 26-2 says
Apr 172026
SR 26-2 and OCC Bulletin 2026-13 replace SR 11-7 as the model risk guidance for banks
$30B
in assets: the size SR 26-2 says it is most relevant above; it is not an enforceable standard
1/yr
minimum frequency of independent reviews of the IRR measurement process in the FDIC manual
3
elements of an effective validation in the 2012 interagency IRR FAQ: soundness, monitoring, outcomes
What does ALM model validation include?
ALM model validation includes three things: a review of conceptual soundness (is the model, and each assumption method, right for this balance sheet), ongoing monitoring (are the inputs complete and is the model still used as intended), and outcomes analysis (do the model's forecasts and assumptions match what happened, which is back-testing). The 2012 interagency FAQ names exactly those three as "an effective model validation policy" (Interagency IRR FAQ, 2012, question 9), and the Basel Committee's interest rate risk standard names the same three, specifying "backtesting of key internal parameters (eg stability of deposits, prepayments, early redemptions, pricing of instruments)" (BCBS, Interest rate risk in the banking book, 2016).
The OCC's booklet turns them into checks an examiner will recognise. Process verification confirms "that data inputs are accurate, complete, and consistent with model purpose and design", including whether extracts reconcile to the general ledger. A review of scenarios and assumptions covers "whether senior management reviewed and approved key assumptions". And ongoing monitoring and outcomes analysis confirm that the model is "functioning as intended (i.e., back-testing)" (OCC Comptroller's Handbook, Interest Rate Risk, 2020).
The 2010 advisory adds the scope of the independent review: "the reasonableness of assumptions, the process used in determining assumptions, and the backtesting of assumptions and results", with follow-up "to monitor management's corrective actions" (Interagency Advisory, 2010). Note where the weight falls. Three of the four items are about assumptions; only the mechanics are about the software.
Validating IRR models is a fundamental part of any institution's system of internal controls.
Interagency Advisory on Interest Rate Risk Management, January 2010
Is SR 11-7 still in effect?
No. On April 17, 2026 the Federal Reserve issued SR 26-2, which supersedes SR 11-7 and SR 21-8, and the OCC issued the same guidance as Bulletin 2026-13, rescinding its "Model Risk Management" handbook booklet; the FDIC joined the guidance (SR 26-2; OCC Bulletin 2026-13). Any validation policy, procedure or report that still cites SR 11-7 or OCC Bulletin 2011-12 as its authority needs updating.
The new text changes three things a validator should notice. It narrows the definition of a model to complex quantitative methods grounded in statistical, economic or financial theory, leaving out spreadsheet arithmetic and deterministic rules. It says plainly that it sets no enforceable standards. And it puts generative and agentic AI outside its scope. What the definition does to one family of bank tools is worked through in whether a customer risk rating model is a "model" after SR 26-2. An ALM model that discounts cash flows under behavioural assumptions still fits the new definition.
What the new guidance keeps is familiar. Its attached text describes validation as conceptual soundness, outcomes analysis (naming back-testing as one form) and ongoing monitoring, expects "effective challenge" from people with expertise, independence and the standing to change things, and says vendor models still need ongoing monitoring and outcomes analysis on the bank's own results (Revised Guidance on Model Risk Management, April 2026). For interest rate risk, nothing in it lowers the bar the advisory set.
Does SR 26-2 apply to a community bank's or credit union's ALM model?
SR 26-2 says it is most relevant to banking organisations with more than $30 billion in assets, and it was issued by the Federal Reserve, the OCC and the FDIC; the NCUA did not join it. A community bank or credit union does not escape ALM model validation, though: the interest rate risk advisory, co-issued by all the banking agencies and the NCUA, and each regulator's manual still expect an independent review that covers assumptions and back-testing.
Which validation text applies to whom
| Text | Who it reaches | What it expects for an ALM model |
|---|---|---|
| SR 26-2 / OCC Bulletin 2026-13 (April 2026) | Banks; most relevant above $30 billion; not enforceable | Conceptual soundness, outcomes analysis including back-testing, ongoing monitoring, effective challenge, vendor models included |
| Interagency Advisory on IRR Management (2010) and FAQ (2012) | Banks, thrifts and federally insured credit unions of every size | Independent review of assumptions and back-testing; vendor certifications not enough on their own |
| OCC Interest Rate Risk booklet (2020) | National banks and federal savings associations | Process verification, assumption review, back-testing; small banks compare actual with forecast at least annually |
| FDIC RMS Manual 7.1 (10/2025) | Banks the FDIC examines | Independent review at least annually by people with no operational role; variance analysis at least annually |
| NCUA, 12 CFR 741.3(b)(5) and Appendix A | Federally insured credit unions above $50 million | Internal controls and periodic assessment; above $500 million, outside parties to validate tests and limits |
| BCBS, Interest rate risk in the banking book (2016) | Internationally active banks, through national supervisors | Outcomes analysis including back-testing of deposit stability, prepayments and pricing |
Who can validate an ALM model?
Anyone with the skill to do it who takes no part in running the model. The FDIC's manual sets the bar most precisely: reviewers must be "independent of any operational responsibility for the measurement and management processes" and "should not perform any of the routine internal control functions such as reconciling data inputs, developing assumptions, or performing variance analysis" (FDIC RMS Manual 7.1). They may be internal staff, an outsourced reviewer or a mix, and senior management must ensure they "have the knowledge and skills to competently assess the measurement system".
Size changes who, not whether. The advisory accepts that smaller institutions often "use an internal party that is sufficiently removed from the primary IRR functions or an external auditor". The OCC expects large or complex banks to have the model "audited or validated by an independent party such as independent risk management, auditors, or consultants". NCUA's appendix suggests that credit unions of $500 million or more provide in their policy for outside validation of their tests and limits.
Independence on paper is not the same as challenge in practice. The Federal Reserve's review of Silicon Valley Bank found that its Financial Risk Management group "acted more in collaboration than as an effective challenge to the business" (Federal Reserve, SVB review, April 2023). A second line that receives the first line's numbers and checks the prose around them is collaborating. A second line that rebuilds the number from source data is challenging.
How often should an ALM model be validated?
No regulator fixes a single interval for a full validation, but several annual minimums apply. The FDIC expects independent reviews "at least annually" and findings reported to the board "no less frequently than annually"; it also expects variance analysis "no less frequently than annually". The OCC says that at small and less complex banks "periodic comparisons of actual performance with forecast may be sufficient but should be performed at least annually".
Events also trigger validation work. SR 26-2's guidance ties the timing of validation to the model's purpose and the frequency and scope of changes, and expects validation before a model is first used, with closer monitoring if urgent use comes first. In interest rate risk the most frequent change is not new software but a changed assumption, which is why the strongest practice is to validate each material assumption change before it takes effect, and to run the full review once a year.
A vendor's certification is not your validation
Most community banks and credit unions run a vendor's ALM model, and the vendor's model certification covers the mechanics and mathematics, not your data or your assumptions. The 2012 FAQ was asked this directly: can certifications commissioned by vendors satisfy supervisory expectations for validation? Its answer begins "No." and continues that each institution must ensure "the selected model is appropriate for its IRR profile by conducting an independent review and validation and performing ongoing monitoring and back-testing" (Interagency IRR FAQ, question 9).
The FDIC says the same: a vendor's certification "is only one component of a bank's independent review and should not be used as a substitute for an overall validation review." The FAQ adds a task validators often skip: management "should document and justify the institution's customization choices as part of the validation process", and where vendors supply assumptions, assess "whether the data is representative of the institution's situation". A vendor's default deposit decay curve is an assumption like any other, and it needs the same support.
How do you validate deposit assumptions?
Validate deposit assumptions by recomputing each one from the institution's own account data, comparing it with what the model assumed, and testing whether the gap is real: a one-time event, a data error or a choice of cohort can each make an assumption look broken when it is not, or sound when it is not. The FDIC warns about the last case: "Even if material financial variances are absent, the model's significant assumptions should be compared to actual performance. Compensating differences may have masked important variances."
Take the sample credit union's regular share decay. The model assumed 14.0% a year from a 2024 deposit study; the first line measured 22.6% on 498,300 accounts holding $1,420.6 million. A validator should ask three questions before accepting the new number. Was it a one-time event? Without the four months of a 13-month certificate special, runoff would still have been 17.4%, 3.4 points over the assumption, and next year's budget plans two more specials. Is it a data error? Dormancy closures inside the cohort were 1,210 accounts and $0.9 million, worth 0.06 points. Does the cohort choice change it? Counted by accounts, runoff was 8.4%; by balances, 22.6%, and the model uses balances, as the study did.
Each answer needs evidence the validator can trace. How the decay itself is calculated, and what the error costs in NEV and limits, is worked through in the deposit decay rate guide; checking every assumption this way each quarter is the subject of what back-testing is in interest rate risk.
What the validator needs from the first line
A validator needs evidence for each element of the validation, assembled so that every figure can be traced to its source without asking the first line. The table maps each element to what the ALM team should hand over; it is also a fair description of what an examiner's request letter will ask for.
Interest Rate Risk (IRRBB) Management: each validation element, and the evidence behind it
| Validation element | What the validator tests | Evidence the first line hands over |
|---|---|---|
| Data and process verification | Inputs are complete and tie to the books | Every extract with its general ledger tie-out and difference; manual upload steps; chart of accounts |
| Conceptual soundness | Model and assumption methods fit the balance sheet | Method for each assumption (cohort, weighting, period); vendor certification; documented customisations |
| Assumptions and approvals | Values are supported and were approved before use | Register of assumptions with source, date, approver; change memos; ALCO minutes |
| Outcomes analysis | Forecasts and assumptions match what happened | NII forecast against actual with drivers isolated; each assumption assumed against observed, with tolerance |
| Sensitivity analysis | Which assumptions drive the results | Runs with key assumptions moved up and down, and their effect on every limit |
| Ongoing monitoring | The model is still fit as products and markets change | Quarterly back-test calendar; escalations; new products assessed before launch |
| Effective challenge | The reviewer reached the number independently | Independent recompute from raw data; other explanations tested and documented |
| Follow-up | Findings are remediated | Prior findings, management responses and the corrective-action plan |
Every number opens its source passage
The validation package for one assumption change
- The extract, its cohort definition and its general ledger tie-out
With the difference stated, not just a pass.
- The assumed value, its source and its approval date
Which study or analysis produced it, and which ALCO approved it.
- The observed value and the arithmetic
Balance-weighted or account-weighted, and why that choice matches the model.
- The causes of the gap, each with an amount
So the validator can test whether they recur.
- Other explanations tested
One-time events, data errors, cohort choice, seasonality.
- The re-run at every shock, alone and with other open changes
Two changes that each pass can together cross a limit.
- The memo, with every figure cited
What the model assumes, what happened, why, the impact and the recommendation.
- The validator's decision with a reason and any condition
An acceptance with a re-test date is stronger evidence than a bare approval.
Challenge before the memo: an independent recompute
The strongest validation evidence for an assumption change is a second calculation, made from the raw data by the second line, before it reads the first line's conclusion. Benchmarking is an old idea in this field: the advisory describes "constructing an identical model to test assumptions and outcomes or using an existing, well-validated 'benchmark' model". What is new is doing it for every changed assumption, every quarter, without doubling the validator's workload.
In Interest Rate Risk (IRRBB) Management the validator has an agent of its own. The Challenge agent works for Model Validation, reads the raw core extract and never sees the first-line memo before its recompute. In the sample it recomputed regular share decay at 22.58%, against the first line's 22.6%, then tested the alternatives above. The validator, not the agent, decided: accept with a condition, re-test next quarter, and bring a revised value if runoff without certificate specials falls under 17%.
The second line reaches the number before it reads the argument
Agent
Read the raw extractLoads the same core extract the first line used, with duplicates excluded and the cohort rebuilt from its definition.
Never: opens the first-line memo first
Agent
Recompute the valueRecomputes balance-weighted runoff independently and states the difference from the first line's figure.
Agent
Try to explain it awayTests a one-time event, a data error and the cohort choice, each with its result and citation.
Never: decides
A person decides
Validator decidesAccepts, accepts with a condition or challenges on data, method or support, with a reason code.
A person decides
ALCO sees the decisionThe change reaches the agenda with the validator's decision and condition attached.
ALM model validation: the second line's own recompute
The trail matters as much as the decision. Every step by a person or an agent is kept with who, what, when, why and the evidence, so the validation report for the year is an export of the decisions already taken, not a reconstruction. How that trail serves the board, ALCO and the policy is covered in who signs an interest rate risk policy.
Every action by a person or an agent, kept for the examiner
Questions people ask
What is interest rate risk model validation?
It is the independent review of an institution's interest rate risk model: its data, method, assumptions and outputs. The 2010 interagency advisory says the review should cover the reasonableness of assumptions, the process used to set them, and the back-testing of assumptions and results, with follow-up on corrective actions.
Is SR 26-2 enforceable?
No. The guidance states that it does not set enforceable standards or prescriptive requirements and that non-compliance will not by itself lead to supervisory criticism, although unsafe practices in managing model risk still can. The interest-rate-specific expectations in the 2010 advisory and the examination manuals remain in place.
What is outcomes analysis for an IRR model?
Outcomes analysis compares what the model forecast with what happened. For an earnings model that usually means projected against actual net interest income or margin, with drivers isolated; for assumptions it means each assumed decay rate, beta or prepayment speed against the observed value. The OCC notes that back-testing an economic value model is harder because market prices are not available for every instrument.
Can internal audit validate the ALM model?
It can perform the independent review if it has the skills and no role in running the model; the FDIC expects internal audit to define the review's scope in most cases. The OCC adds that internal audit should not necessarily duplicate model risk management but should determine whether it is effective.
Does a credit union need ALM model validation?
NCUA does not issue model risk guidance like SR 26-2, but its Appendix A expects internal controls and periodic assessment of the interest rate risk program, and for credit unions of $500 million or more suggests outside parties to validate tests and limits. The 2010 advisory, which NCUA co-issued, expects independent review of assumptions and back-testing.