Staffing a Model Validation Backlog With Contractors Before the Examiner Asks

Last updated: November 10, 2026

By Khurram Tehseen, FSA, Founder and Principal at Operating Alpha

Clear a model validation backlog with contract validators who did not build the models, plus a documentation analyst who writes what a committee can read. As of October 2026, a senior contract data scientist and a mid-level business systems analyst model at about $107,300 for three months at KORE1 Contract Rate Index 2026-Q4 national medians.

Top of a model inventory, lender invented.

Twenty-two blanks. Nobody left them blank on purpose. The person who built M-02 left in 2023, the owner of M-07 is still TBD, and no quarter in the last three years has been free for validation work. Inventories get this way when the list comes first, because somebody asked for a list, and the checking waits for a calendar that never opens.

Then a date turns up. It might be an exam, an audit, a lender’s diligence request, or a committee asking which of these models decide anything, and the sheet stops being housekeeping and becomes a schedule that is longer than the team. What follows covers who clears it, in what order, and what they leave behind.

You are reading this on KORE1’s site, and KORE1 places the contract data scientists for model validation and the analysts I describe through its contract staffing practice, so discount the staffing advice by whatever you think that is worth. The sequencing and documentation advice works just as well with people from your own bench.

One change before the seats. If your model risk policy cites SR 11-7 or OCC Bulletin 2011-12 by name, it cites guidance that was replaced on April 17, 2026. The last section covers what the replacement says about validators.

Who Validates, Who Documents, and Who Stays Independent of the Build?

There are three seats, and two of them go to contractors.

The validator is a senior data scientist who did not build the model and does not use it. The job is to read the method, rerun it on the source data, test the result against what happened, and write down what the model can and cannot be trusted to do. Senior matters. A validator who can’t reproduce a loss severity estimate from the raw recoveries sends every question back to the owner, and you have bought a reader instead of a reviewer.

The documentation analyst is a mid-level business systems analyst, and this is the seat that gets cut first. Somebody has to sit with each model’s owner, open the code or the workbook, trace every input to the system it came from, and write the one page a committee will actually read. Validators write for other validators. That is how a committee ends up approving a binder on the strength of a two-paragraph cover memo. The analyst writes for the people who vote. If your shop already runs regulatory documentation through analysts, compliance analyst staffing fills a close cousin of this seat.

The third seat is yours. A named employee, usually the head of the function the model serves, accepts the findings, funds the fix, and answers to the committee. Contractors bring evidence. They cannot bring standing, and the guidance text near the end of this piece explains why that line matters.

Independence comes down to three working rules. Whoever built a model can document it but cannot validate it. A validator who also rebuilds the model is reviewing their own work by month two, so findings go to the owner and the owner fixes. And a validator should come to the model cold, which rules out the contractor who tuned it last year.

KORE1 partner Devin Hornick described how these engagements are billed: “Hourly, which we prefer. It’s really more of a staffing model to do the hourly billing and you manage the person.” You manage the person. For a validation seat that sentence does real work. You choose which models, set the order, read what comes back, and decide what done means. Hand all of that to the contractor and you have handed over the oversight with it.

What Does Model Documentation a Committee Can Read Look Like?

Model documentation a committee can read is one plain page per model that says what the model decides, who owns it, what it was built on, where it is known to be weak, when someone last tested it against what happened, and what is still open.

Here is one page.

Example only. The model and the numbers are invented.

Read the result line. Twenty-eight of 41 resolved loans recovered less than the model said, and that is a finding. In a forty-page method file it can sit on page 31 under a heading about back-testing. On the one-pager it is the third line from the bottom and a committee cannot miss it. The thick file stays in the drawer for the people who need it. I use the same one-page format in AI model governance for insurance, where the models differ and the page does not.

The analyst’s hardest word to write is “unknown.” The builder of M-02 is gone, the code carries comments in two styles, and nobody can say why the collateral types were grouped the way they were. Write that down, tagged as unknown, in place of a plausible reconstruction. I describe the tagging in how to mark what your data cannot support. A committee can live with an honest unknown. It can’t live with a confident paragraph that turns out to be a guess.

On documentation the agencies’ text is brief. It says documentation supports “the tracking of recommendations, responses, and exceptions” and helps manage remediation, which a findings line and a named owner handle fine.

Have You Measured Your Own Calibration?

Probably not. Most shops have never put underwritten and emerged side by side on their own seasoned deals, and the result says more about whether a model works than another pass through its method.

Calibration is the gap between what you underwrote and what actually emerged, measured on your own record. Validation has a name for the test. The 2026 guidance calls it outcomes analysis, which “compares model outputs to corresponding real-world outcomes” and “can take many forms,” back-testing among them. For a credit model the outcome is the loan that paid or didn’t. For an insurance model it is the policy that lapsed or didn’t, or the claim that cost what the reserve said or something else.

A model can pass every documentation check and still miss in the same direction every time. Method review won’t catch that. Three seasoned deals might. Pick three that have been through enough reporting cycles for the case and the actuals to sit next to each other, line up the assumptions the committee approved against what emerged, and look for the one that misses the same way on all three. One miss is a story. Three in a row is a habit. I run this as a model calibration study, and the inputs are the original credit memos and the servicing reports you already have.

Put one calibration read in the first month of the backlog’s scope. Do it early. If a model misses the same way on its own seasoned deals, you want to know before the documentation analyst writes it up as sound.

How Do You Sequence a Backlog: Highest Exposure First, or Oldest First?

Exposure first. Sort by what the model decides and how much money moves on it, and use the age of the last validation only to break ties inside a tier.

The 2026 guidance points the same way. It says the nature and rigor of validation generally align with a model’s “approach, use, and materiality,” which is a polite way of saying the pricing tool gets more of your quarter than the routing macro.

Oldest-first feels fair and clears the wrong models first. Look back at the opening sheet. The oldest date on it, March 2022, belongs to a scorecard somebody did examine. The never-validated pricing tool is the one setting spreads on every sponsor deal. Fairness is not the goal here.

Three tiers are enough. The weights below are my planning assumptions, not a benchmark, and your models will argue with them.

Now the arithmetic. One validator for three months is about 13 working weeks. At those weights that is two Tier 1 models, two Tier 2, and one Tier 3, with no slack. Five models. The 22 blanks in the opening sheet, if they split 4, 8, and 10 across the tiers, come to 42 validator-weeks, a little over three validator-quarters. Three validators for a quarter, then, or one validator for ten months. Your split will differ. Count first. Then buy seats.

Two cheap moves come before any of it. Give every model an owner, which takes a week and no budget. And write down the limits on the models that are still waiting. The guidance says that where a model is used before validation is finished, sound practice means closer attention to its limitations, telling the people who rely on it, and controls such as limits on use or tighter monitoring. A backlog is a long time to run on an unwritten limit. Write it down.

What Do SR 26-2 and OCC Bulletin 2026-13 Say About Validator Independence?

SR 26-2 and OCC Bulletin 2026-13 replaced SR 11-7 and OCC Bulletin 2011-12 on April 17, 2026. They ask for effective challenge by people with expertise, independence, and the standing to effect change.

First, what I am and am not doing. I am summarizing text. I am not advising on compliance, and I would not try to guess how a given examiner reads a given sentence. The primary documents are the Federal Reserve’s SR 26-2 and the OCC’s Bulletin 2026-13, and the guidance attached to them runs twelve pages. Read it before you rewrite a policy off my paragraphs.

Start with effective challenge, because that is where independence lives. The text says it is performed by individuals with “the appropriate expertise to conduct a critical and objective challenge, sufficient independence to maintain objectivity, as well as the organizational standing and influence to effect any change.” Three things, and a contractor can plausibly bring two. Expertise, yes. Independence from the build, yes. Standing and influence, meaning the ability to make a model owner change something on a Tuesday, no, and I would not pretend otherwise. That one belongs to the employee in the third seat.

The rest of the relevant text is shorter than people expect. Validation quality “depends on the rigor and effectiveness of the review rather than on organizational structure,” which reads as less concerned with where a validator sits on the org chart than with whether the review is any good. Roles should be clear, conflicts of interest included, and the example it picks is misaligned incentives between the development group and the validation group. And for firms that use external resources to help manage model risk, it asks for “proper oversight,” integration into the wider program, and clear roles when you delegate. That last passage is the one a contract engagement lives under, and it is why the “you manage the person” line earlier was more than a billing remark.

Scope next. The guidance is addressed to banking organizations, and the agencies say it is expected to be most relevant to those with more than $30 billion in total assets. Generative AI and agentic AI models are outside it. It does not set enforceable standards or prescriptive requirements. If you are an insurer, a private credit manager, or a lender without a bank charter, this text is not addressed to you, and carriers have their own state rules, which I cover in how carriers document each model under the NAIC bulletin. Its vocabulary still makes a sensible template for the written policy you hold yourself to.

One practical step, and it takes a minute. Search your model risk policy for “2011-12” and “11-7.” Wherever either appears, that is your first edit.

Questions Before You Staff the Backlog

So what does a contract validator actually cost?

About $107 to $132 an hour nationally for a senior contract data scientist, median $122, per KORE1’s modeled 2026-Q4 index cell. As of October 16, 2026, three months at 40 hours a week and the median comes to about $63,600, and six months about $127,100. Those are bill rates, which means wages, payroll taxes, insurance, and the staffing firm’s own recruiting and account management are all inside the hourly number. Metro moves it. New York runs about $68,800 for the quarter, Boston about $66,500, Chicago about $57,000. Add a mid-level business systems analyst for the documentation seat, about $43,700, and the pair lands at $107,300.

Can a contractor be an independent validator?

Often yes, if they did not build, tune, or use the model and do not report to whoever did. The 2026 guidance asks for “sufficient independence to maintain objectivity” and, in the same sentence, for the standing to effect change. A contractor can have the first. The second is mostly a title and a budget line, which a contractor does not get, so put an employee’s name on it and have that person accept the findings. Findings that nobody senior has agreed to read tend to stay findings.

How long until the blank column is full?

Count validator-weeks, not models, since one validator for three months is about 13 weeks of work and clears roughly five models at my planning weights, two high-exposure, two middle, one light. A backlog of 22 blanks split 4, 8, and 10 across the tiers needs about 42 validator-weeks, so you size the team to the calendar you are working against, not the other way around. For scale, across 1,887 ended KORE1 contract assignments the median ran 116 days, with a quarter ending inside 44 days and a quarter running past 227. Plan a quarter for the first tier and ask for a month of slack on top.

Does the documentation analyst have to be a different person from the validator?

Keep the documentation analyst separate from the validator, because the two jobs write for different readers and fight over the same hours. A validator who also writes the committee page tends to hand in the validator’s version, which is the binder again. The analyst costs less per hour than a senior validator, too, so splitting the seats usually comes out cheaper than stretching one person across both.

Should the validator fix what they find?

The model’s owner fixes what the validator finds, and the validator retests the repaired model. Each finding goes to the owner with a name and a date, and the repaired model comes back for a second look. A validator who rewrites the model ends up reviewing their own work, and the next reviewer inherits a model that no longer matches its documentation.

Start With the Ten Models That Decide Something

Open your inventory and add one column. Call it “what it decides.” Ask each owner to fill it in with a single sentence, and watch which ones come back empty or vague. Sort by that column, tier by tier, and the top ten rows are your first quarter. If more than a few say “don’t know,” fix that before you hire anyone, because a validator can’t test a decision nobody can name.

If the ranking is hard to call, I am glad to talk it through. Connect with me on LinkedIn.