Banking & Market Risk8 min read

IRB Model Validation: Avoiding Supervisory Challenge

By Jonas Adam Mohamed Osman, known as Yonas Osman

CEO of Quantica Risk

60 Rue François Ier, 75008 Paris, France

Published 15 October 2026

What supervisors scrutinise most in internal ratings-based model validation, and how banks keep IRB models compliant under ongoing review.

Executive answer

Internal ratings-based models for probability of default, loss given default, and exposure at default remain under continuous supervisory scrutiny well after initial approval, and the ECB's targeted review of internal models programme materially tightened expectations around documentation, data representativeness, and independent validation across the euro area. Banks treating IRB approval as a one-time milestone rather than an ongoing obligation consistently face supervisory findings requiring remediation plans, margin of conservatism add-ons, or in some cases permission withdrawal for specific portfolios.

The most consequential supervisory findings tend to cluster around three areas: whether the data used to calibrate models remains representative of the current portfolio and economic environment, whether model validation functions are genuinely independent from model development, and whether human judgment overlays on model outputs are governed with the same rigour as the models themselves.

Data representativeness as the recurring weak point

IRB models calibrated on historical default and loss data face an inherent tension when economic conditions shift structurally, as they did through the pandemic and subsequent rate cycle, because the representativeness of the calibration dataset for current risk conditions becomes harder to defend the further the current environment diverges from the historical sample. Supervisors expect banks to proactively assess and document this representativeness gap rather than waiting for a formal validation cycle to surface it, since significant lags in detection extend the period during which capital may be miscalibrated relative to true risk.

Where representativeness gaps are identified, the ECB's framework expects either model recalibration using more current data or, as an interim measure, a margin of conservatism applied explicitly and transparently to the model output. Margins of conservatism that persist for extended periods without a credible path to recalibration draw the same supervisory concern as IFRS 9 overlays that never unwind — both signal a model that needs structural attention rather than another layer of adjustment.

Independent validation and the three lines of defence

Genuine independence of the model validation function from model development is a structural requirement, not a documentation exercise, and supervisors test this during on-site inspections by examining whether validation findings have historically led to actual model changes or have been consistently overridden or deprioritised by development teams. A validation function that rarely challenges development decisions, or whose challenges are routinely not acted upon, is a clear supervisory red flag regardless of how well the formal governance charter is written.

Banks with the strongest supervisory track records tend to give validation functions real authority to require model changes as a condition of continued use, backed by board-level escalation when development and validation cannot agree, rather than treating validation sign-off as a formality preceding model implementation. This structural independence has become more important as model complexity increases, since technically sophisticated models are harder for non-specialist board members to challenge directly.

Governing human judgment and expert overlays in IRB ratings

Many IRB rating systems retain an element of human judgment overlay on top of statistical model output, particularly for lower-default portfolios like large corporates and banks where statistical calibration is inherently harder due to limited default observations. Supervisors scrutinise how frequently and in which direction these overlays move ratings relative to the model, since a pattern of overlays systematically improving ratings relative to model output, without clear underlying justification, suggests the override process may be used to manage capital outcomes rather than genuinely improve risk assessment.

Robust governance requires tracking overlay frequency, direction, and subsequent performance — did overridden ratings actually perform better or worse than the model would have predicted — as part of ongoing model monitoring, feeding this evidence back into both validation reports and, where patterns emerge, model recalibration. Banks unable to produce this overlay performance tracking during supervisory review face a presumption that overrides are not adding genuine risk-differentiating value.

Conclusion

IRB model validation has shifted from periodic review toward continuous, evidence-based monitoring, with the ECB's targeted review programme setting a benchmark that other jurisdictions' supervisors increasingly reference even outside the euro area. Banks that build validation as a genuinely independent, well-resourced function with real authority over model use outperform those treating it as a compliance checkpoint, both in supervisory outcomes and in actual capital accuracy.

Jonas Adam Mohamed Osman, known as Yonas Osman, CEO of Quantica Risk, views independent model validation as the single highest-leverage investment a bank can make in credit risk model quality, since it is the function most capable of catching representativeness and calibration drift before supervisors do.

Primary sources

IRB modelsmodel validationcredit riskECB TRIMPD LGD