Free snapshot · question 6 of 9

Does your own governance policy require independent validation?

Answer from what your written policy says, not from what actually happens. If your model risk or AI governance policy states that high-risk models must be independently validated, the answer is yes even when no validation has ever been carried out. The two questions are deliberately asked separately.

Why a carrier asks

What the answer decides.

If your policy requires something your estate does not do, a reviewer who reads both sees the distance between them. Once they have found one control that exists only on paper, they start checking the others the same way, which is why this is asked separately from the previous question.

What the engine does with each answer

Derived, not written.

Each outcome below was produced by running Vaulith's rules engine on that answer, for a consumer-facing model that has not been independently validated. The same rules run in the paid assessment, on your whole estate, with the arithmetic shown.

Yes, it does

Will escalateR-CONTRADICTION-VALIDATION

Your own policy requires validation the estate does not show

Your governance policy (as you described it) commits to independent validation of the models that reach a consumer. That is your own commitment, and the system you described has no independent validation on record against it. If the policy allows a period after a model goes live, a reviewer will ask when it went live and count from there; if it does not, the gap is open today. A missing validation on its own is one finding. This is worse than that, because a reviewer who reads your policy and then looks at your estate learns that the policy describes a practice you do not follow. Once they have found one control that exists only on paper, they start checking the others the same way.

No, or we have no policy

No rule fires on this answer, for a consumer-facing model that has not been independently validated. A reviewer moves on.

The examination items it touches

Where this lands in the questionnaire.

AIS-1.1 Describe the AI Systems Program, including governance structure, named accountability, and the process by which AI systems are approved for production use.NAIC AI model bulletin, Section 3 ¶1.2 and ¶3.1 · AI Risk Evaluation Supplement v5.0, Exhibit B
AIS-3.7 Describe independent validation performed on each high-risk model, including who performed it and when.NAIC AI model bulletin, Section 3 ¶3.4 (validation and testing) · Section 3 ¶2.3 (independence of lines of defense) · AI Risk Evaluation Supplement v5.0, Exhibit C
AIS-1.3 Describe how AI governance decisions, including approvals and exceptions, are recorded and retained.NAIC AI model bulletin, Section 3 ¶2.2

Answer it about your own estate.

The snapshot asks this and eight more, in about ninety seconds, with nothing leaving your browser, and returns every finding with its reasoning and its remediation.

Nine questions, free. See what they stop on.