Line of business · Specialty and the London market
Every external model you licence owes a fresh validation each year, and it is still assembled by hand.
Understand the model. Name the perils it does not cover. Back-test it. Justify the tooling. Govern every change to it — per external model, per year. The evidence for all of that exists, scattered across inboxes, spreadsheets and the memory of whoever ran the numbers.
What breaks in a syndicate or managing agency today
The dossier is reconstructed, not recorded
The run happened in March. The evidence about it is written in November, from whatever survived — a spreadsheet, a thread, and the memory of whoever ran it. (UC061)
Expert judgement lives in an inbox
The judgement that actually moved the number was made in a meeting. What reaches the dossier is a summary of a summary, with no way back to what was argued. (UC061)
A vendor model version changes under you
Adopting a new version of a licensed model is a capital-grade event handled as a maintenance ticket, and the comparison against the outgoing version is rarely kept. (UC063)
An irreproducible run still ends up in the dossier
Until someone asks for the seed. A run that cannot be re-executed is not weak evidence — it is inadmissible, and finding that out during a review is the expensive way. (UC070)
What holds today, and how you check it
Which pillars answer it
P6 · for the Model Risk Lead
Validation-Evidence Autopilot
The annual validation dossier compiles itself, out of runs that were reproducible on the day they happened — rather than being reconstructed once a year from memory and spreadsheets.
Seeded runs, logged expert judgements and champion–challenger records accumulate as the year happens, so the dossier is compiled rather than reconstructed.
shipped(shipped)P9 · for the Chief Operating Officer
Governed Change Control + the A2A Corridor
Changing a rule, a threshold, a persona or a model version is itself a governed decision that carries a certificate — and the same discipline extends to actions between companies.
Adopting a new vendor-model version is deliberated and certificate-bearing, with the outgoing version still in the record beside it.
designed, not built(designed, not built)P3 · for the Chief Risk Officer
Cross-Model Computed Gate → Sealed Certificate
Two or more heterogeneous models re-derive the answer. A computed — not learned — agreement predicate must pass before anything is released, and the inputs and model versions are sealed into the record.
Before a model change releases, two heterogeneous models must re-derive the answer and agree — the inputs and versions are sealed with the verdict.
shipped(shipped)P5 · for the Chief Compliance Officer
One-Log, Many-Regulator Evidence Fabric
One governed event stream compiles into every regulator’s artefact, instead of four teams reconstructing four different stories from the same week.
One event stream, rendered per reader: the syndicate’s own file, the managing agent’s oversight record and the supervisor’s pack are the same thread.
shipped(shipped)What this does not do yet, for a validation programme
WHAT THIS DOES NOT DO YET
- Drift-detection logic. The alert taxonomy and stores exist; the detection does not.
- A2A migration from the spec version our endpoint conforms to (v0.3.0) to the current one (v1.0.0), plus the party model, claim-state synchronisation and conflict surfacing.
- The jurisdiction-pack emitters.
Read plainly: the dossier compiles from runs that were reproducible on the day, and the detection that would tell you a model has drifted since is not built. The stores and the alert taxonomy for it exist; the logic that fires does not.
REFUSED
HASH_MISMATCH
A run whose seed or inputs no longer re-derive is marked inadmissible, and the dossier refuses to compile around it.
The alternative is a dossier that looks complete and contains a run nobody can reproduce. Finding that during a review costs more than finding it on the day, which is the only reason to make the refusal loud.
Start with one external model
You can put a single licensed model into the run ledger with its validation calendar and change nothing else. The next time that model is re-run, its evidence accumulates as it happens — and the year after that, the dossier is a render rather than a project.