Drill 50 — The Examiner's Question

Theme: Compliance, Privacy & Model Governance · Format: 20-min drill · Difficulty: core

The story

A routine regulatory examination reaches the underwriting model. The examiner's request is standard: evidence that the model was independently validated before deployment — the validation report, challenger comparisons, testing of key assumptions. The team exchanges looks. The model was validated, in the sense that the people who built it walked through the metrics in a sprint review two years ago, verbally, with a slide deck that has since been overwritten. There is no report, no challenger, no record of what assumptions were tested or by whom.

⏸ Stop here and ask the room: what does the examiner conclude, and what happens next?

Run it — facilitator script

Timing: ~2 min story · ~10 min questions · ~3 min reveal · ~5 min transfer.

Read the story, pause at the blockquote, and take predictions before revealing — most rooms guess "a warning"; the actual answer (a formal finding and a frozen roadmap) lands harder after the guesses.

Why does "validated by the team that built it" not count — even if the builders are excellent?

Listen for: independence and effective challenge — builders test the failure modes they already imagined, validators hunt for the ones they didn't; the incentive conflict of grading your own work under deadline pressure; and the examiner's epistemic position — without an artifact, a regulator cannot distinguish excellent self-review from none at all, so both must be treated as none.

Weak signal: "our team is senior enough that it's fine." Competence is not the issue — verifiability is. The examiner isn't questioning the team's skill; they're asking for evidence that skill was applied.

What's the difference between validation as an event and validation as a deliverable?

Listen for: an event convinces the people in the room that day; a deliverable convinces a stranger years later. The artifact is the control — and the sharpest version of the point: if producing the document is hard, the thinking was skipped, not the typing.

Weak signal: treating documentation as bureaucratic overhead to be minimized ("we'll record the meeting"), which misses that the report's table of contents is a checklist of analysis that either happened or didn't.

What would you need to produce this evidence in a day instead of a quarter?

Listen for: the report written before deployment as a gate, stored in the model registry, indexed by model ID; challenger code and test data versioned alongside it; an annual revalidation calendar so the evidence never goes stale; a quarterly rehearsal of exactly this request.

Weak signal: heroic reconstruction plans — "we could pull the old metrics and write it up now." Retro-writing validation evidence for an examiner ranges from a worse finding to a career-ending one; the room should name that danger unprompted.

The reveal

A formal finding: an MRA (Matter Requiring Attention — a regulator's written demand to fix a deficiency, tracked until closed). The remediation program freezes all model changes for months while an independent validation is performed retroactively, under scrutiny, on a model already in production. The documentation that was never written costs roughly ten times what writing it would have — and the roadmap pays the difference.

Why this happens — the mechanics

An examination runs on artifacts, not memories. The examiner was not in the sprint review and cannot interview the past; the only validation that exists, from their standpoint, is validation that left a document behind. This is the asymmetry teams miss: internally, "we walked through the metrics" feels like diligence; externally, it is indistinguishable from nothing. SR 11-7 (the Federal Reserve's supervisory guidance on model risk management, issued in 2011 and the de facto standard across US banking) makes this explicit — it expects independent validation, effective challenge by people with standing to say no, and documented assumptions and limitations, precisely because supervision can only audit what was written down.

Documentation debt is invisible for the same reason the zombie model was: nothing breaks while the debt accrues. The model scores well, the sprint review satisfied everyone present, and the slide deck's overwrite was just someone reusing a template. There is no dashboard for "evidence we would need in an exam," so the gap compounds silently for two years and then comes due in a single meeting — at which point the price is no longer an afternoon of writing but a retroactive validation performed under supervision, with every model change frozen behind it.

The freeze is what makes the cost curve so brutal. An MRA is tracked until the regulator agrees it is closed, and while it is open the institution's appetite for model risk drops to zero — improvements, retrains, even bug fixes queue behind the remediation. The ten-times multiplier in the reveal isn't rhetorical: it is the difference between writing a report while the knowledge is fresh and reconstructing one while your roadmap waits.

Diagrams

Problem — how the failure unfolds:

sequenceDiagram
    autonumber
    participant BL as Builders
    participant MD as Model
    participant EX as Examiner
    participant RM as Remediation
    BL->>MD: Verbal walkthrough in a<br/>sprint review (silent)
    Note over BL: No report, no challenger,<br/>no assumptions test (silent)
    BL->>MD: Deployed to production
    Note over MD: Decisions accumulate<br/>for two years
    EX->>BL: Show pre-deployment<br/>validation evidence
    BL--xEX: There is none - the deck<br/>was overwritten
    EX->>RM: MRA issued
    Note over RM,MD: All model changes frozen -<br/>retroactive validation<br/>under scrutiny

Solution — where the guardrails go:

flowchart TD
    A["Underwriting model built"] --> V["Independent validation by<br/>a team that did not build<br/>it"]
    V --> R["Written deliverables:<br/>validation report,<br/>challenger comparison,<br/>assumptions and<br/>limitations"]
    R --> G["Governance gate: no signed<br/>validation, no deployment"]
    G --> D["Model deployed with its<br/>audit trail already<br/>written"]
    D -.-> M["Annual revalidation on the<br/>MRM calendar"]
    M -.-> AL["Gaps surface internally,<br/>on schedule, before any<br/>exam"]
    E["Examiner requests evidence"] --> H["Report handed over the<br/>same afternoon"]

What good looks like

A validation report with a standing table of contents: (1) model purpose and scope; (2) data sources, lineage, and quality checks; (3) methodology and key assumptions; (4) performance versus challenger and benchmark models; (5) sensitivity and stress testing; (6) limitations and compensating controls; (7) ongoing-monitoring plan; (8) validator identity, independence statement, and sign-off dates.
An independence rule with teeth: validators sit outside the building team's reporting line and hold explicit authority to block launch — effective challenge means someone can actually say no.
A deployment gate wired into the pipeline: a signed validation report attached to the model's registry entry is a technical precondition for production traffic, not a process people remember to follow.
An evidence locker: reports, challenger code, and test datasets versioned and retrievable by model ID and date — the examiner's request becomes a lookup, not an archaeology project.
A tiered revalidation calendar: high-stakes models revalidated annually, all models on material change, with the schedule owned by the Model Risk Management function rather than the delivery team.
A quarterly exam rehearsal: pick a random production model and produce its full evidence pack within one day; every gap found in the rehearsal is a finding you won't receive in the real exam.

The lesson

Model risk management — independent validation, documented assumptions and limitations, effective challenge by people with the standing to say no — is not paperwork bolted on after the science. It is the audit trail of thinking that was supposed to happen anyway; if producing the document is hard, the thinking was skipped, not the typing. SR 11-7 (the Federal Reserve's supervisory guidance on model risk) is the canonical standard: read it once and you'll recognize every requirement as something a careful team would want regardless.

Named concepts: independent validation, SR 11-7 / MRM, effective challenge, documentation as deliverable.

Real-world echoes

Apple Card, 2019: viral allegations that spouses with shared finances received wildly different credit limits triggered a New York State Department of Financial Services investigation. The regulator ultimately found no unlawful discrimination — but the enduring lesson was how badly the episode went while the institutions involved struggled to explain individual decisions on demand. "The algorithm decided" is not an answer an examiner, a journalist, or the public accepts; the explanation has to exist before the question arrives.

Transfer

Pick our highest-stakes production model and ask for its validation report today. If the answer involves the word "basically" or a meeting instead of a document, we already have the finding — we just haven't received it yet.

Make it a ticket: File the request formally with a one-day deadline; whatever gap surfaces becomes a governance backlog item, with the estimated cost of a retroactive validation attached so the prioritization argument writes itself.

Drill 49 — The Zombie Model — without the inventory, there is nowhere for the validation report to live and no list of models to revalidate.
Drill 52 — The Proxy Variable — disparate-impact testing belongs inside the validation scope this drill formalizes.
Case 8 — the underwriting case study: the same evidence burden seen from the applicant's side, where adverse-action notices force the model to explain individual decisions.