Independent Model Review · Personal capacity

Who reviewed the model?

Independent validation of credit and decisioning models, run against a published framework. One model or decisioning system, three to four weeks, fixed scope and fixed price, delivered remotely.

Building a model has never been cheaper. The cost of verification has not moved. Someone still has to establish whether the model works, whether it is being used the way it was designed to be used, and whether anyone would notice if it quietly stopped working.

Book a 30-minute scoping call → Read the framework

Pedram Nourani, PhD, CPA, CA ANZ

The problem

Building a model got cheap. Verifying one did not.

Models now make decisions that people used to make. Who gets credit, and at what price. Which applications get flagged. Which claims get paid without a human ever reading them. Which transactions get blocked.

Machine learning libraries, vendor decisioning platforms and generative AI have collapsed the cost of production. The cost of verification has not moved. In a large bank, establishing whether a model still works belongs to a model risk team. In most other financial services firms, it belongs to nobody.

Regulators have noticed, and they are not moving in one direction. In April 2026 the US banking agencies replaced SR 11-7 with a lighter, risk-based framework and placed generative and agentic AI explicitly outside its scope. Two weeks later APRA wrote to every bank, insurer and superannuation trustee it regulates and said close to the opposite: governance is lagging adoption, point-in-time assurance is not keeping up with systems that drift, and risk and internal audit functions must be capable of independently reviewing AI.

If your firm is not APRA-regulated, none of that binds you directly. It reaches you anyway. Warehouse funders are APRA-regulated banks, and APRA now expects them to see through their supply chains. Auditors ask who validated the provisioning model. Boards ask who checked the pricing engine, because directors' duties do not have a technology carve-out. The question always arrives from outside, and it is always the same question: who reviewed the model, and what did they find?

The methodology is published in full, because the methodology is not the secret. What an independent review adds is not the checklist. It is the independence.

The framework is public.

Independent Model Review v1.0 sets out what counts as a model, how to tier one before you test it, and the five questions every review answers: design, data, performance, production integrity, and ownership. Read it, run it internally, or have the questions answered independently.

Read the framework → Download the PDF

Engagements

Three ways in. All fixed price.

All engagements follow the published framework, Independent Model Review v1.0. The methodology is public. What you are buying is the independence, the testing, and the attestation.

Engagement 01

Model Risk Diagnostic

AU$5,500Ex GST · One week

A structured assessment of your model landscape against the five questions in the framework. Desk-based: documentation, monitoring packs, and up to three hours of interviews. No independent recomputation of performance at this stage.

A model inventory with risk tiering
A gap assessment against each of the five questions
A prioritised findings summary
A recommendation on whether a full review is warranted, and for which model first

The diagnostic fee is credited in full against an Independent Model Review commissioned within 90 days.

For firms that want to know where they stand before a funder, an auditor or a director asks

Engagement 02

Independent Model Review

AU$27,500Ex GST, per model · Three to four weeks

The full engagement described in the framework. One model or decisioning system, reviewed against the five questions, with independent recomputation of performance wherever the data allows, and interviews with the owner, the developer or vendor, and the people who use the output.

A validation report, written for a board rather than a data scientist
A findings register, with every finding rated High, Medium or Low
An attestation of scope: one page stating what was reviewed, as at what date, on what evidence, and what was not reviewed

The attestation is the document funders and auditors ask for. It is written so it can be forwarded.

Fixed scope · Delivered remotely · Findings addressed to the board, audit committee or funder

Engagement 03

Annual Re-review

AU$15,000Ex GST, per model · Two weeks

For models previously reviewed under this framework. Covers changes since the last review, the effectiveness of monitoring over the period, re-testing of headline performance, and an updated attestation.

Changes since the last review
Effectiveness of monitoring over the period
Re-testing of headline performance
An updated attestation of scope

This is what keeps the attestation current, so the answer to "who reviewed the model" never ages past twelve months.

Tier 1 models should be re-reviewed annually or on material change, whichever comes first

How a review runs

Three stages, four weeks.

A review is fixed in scope and fixed in price: one model or decisioning system, three to four weeks, delivered remotely.

Scope & evidence

Week 1

Confirm the model under review and its tier. Agree the evidence list and access. Schedule interviews with the model owner, the developer or vendor contact, and the people who use the output.

Model & development documentation
Development and performance data
12 months of monitoring packs
Change log & version history
Override & exception reports
Vendor documentation & contract terms
Model risk, data & AI policies

Testing

Weeks 2 to 3

The five questions, run against the evidence. Independent recomputation of performance wherever the data allows it. Interviews to test whether governance on paper is governance in practice.

Reporting

Week 4

Draft findings issued for management response. Final report and attestation delivered.

IndependenceFindings are addressed to the board, the audit committee or the funder, not to the model owner. I do not remediate findings I have raised within the same engagement, for the same reason an auditor does not audit their own bookkeeping. Client data stays in the client's environment wherever practicable. Where extracts are required, they are minimised, agreed in writing, and destroyed on completion.

What you receive

Three documents. One of them gets forwarded.

A review is a point-in-time opinion on a defined scope, written so the people who have to rely on it can read it, challenge it, and file it.

Document 01

The validation report

Written for a board, not for a data scientist. Each finding stated plainly, with the evidence behind it and what it means for reliance on the model.

Document 02

The findings register

Every finding rated by severity, so the response can be prioritised rather than debated.

HighThe finding undermines reliance on the model's output, or creates a breach of an obligation. Address before continued reliance.
MediumA weakness that degrades performance or control but does not yet undermine reliance. Address within an agreed window.
LowAn improvement opportunity.

Document 03

The attestation of scope

The page they actually ask for

One page. What was reviewed, as at what date, on what evidence, and what was not reviewed. This is the page funders and auditors actually ask for, because it is the page they can rely on and file. It is written so it can be forwarded.

Engagement terms

Stated up front, not negotiated later.

Prices are published because a review that starts with a quote negotiation starts in the wrong place. Fees are per model, ex GST.

Delivery: Remote as standard. On-site by arrangement, with travel at cost.
Confidentiality: NDA as standard. Your data stays in your environment wherever practicable. Where extracts are required, they are minimised, agreed in writing, and destroyed on completion.
Independence: Findings are addressed to the board, the audit committee or the funder, not to the model owner. I do not remediate findings I have raised within the same engagement. Remediation support is available as a separate engagement, after the report is delivered.
Payment: Fifty per cent on commencement, fifty per cent on delivery of the draft report.
Scope: Fees are per model. Where several models share data infrastructure and governance, additional models within the same engagement are quoted at a reduced rate.
What a review is not: A review is a point-in-time opinion on a defined scope. It is not remediation, not model development, not a guarantee against loss, and not legal advice.

For advisory firmsI take referred and subcontracted validation work under your engagement terms.

Free tool

The AI Task Exposure Auditor maps which finance tasks AI absorbs first, and which ones still need a person to sign. Every assumption is published, same as the framework.

A considered next step

Book a 30-minute scoping call.

Book a 30-minute scoping call →

Thirty minutes, no charge: what the model does, what evidence exists, and whether a diagnostic or a full review is the right starting point. If a call is not convenient, email [email protected] and include your firm, the model or system in question, and what prompted the enquiry.