ECL Model Validation IFRS 9: What Auditors Actually Check

For CFOs, risk officers, and finance teams at GCC and MENA banks who need their ECL model to pass a Big Four review — not just look like it might.

✓ Written by Prima Consulting’s advisory team  ·  ✓ Serving GCC, Europe & APAC  ·  ✓ Actuaries + CPAs + CFAs

TL;DR

ECL model validation under IFRS 9 is what separates banks that pass audits cleanly from those that spend Q4 in remediation mode. This article walks through the five areas a Big Four auditor checks when reviewing your ECL model: governance and documentation, PD/LGD/EAD methodology, forward-looking overlays, backtesting results, and management overlay justification. For each area, you’ll see what passes and what raises a flag. It closes with the most common deficiencies we see in GCC bank ECL models and how to fix them before your next audit cycle.

Why ECL Model Validation IFRS 9 Keeps Getting Banks Into Trouble

The UK Prudential Regulation Authority said it plainly in its September 2025 thematic feedback letter: model risk remains elevated across major banks, with current credit risk factors differing from those existing models were built to capture. That’s a regulator telling CFOs their ECL frameworks are behind the risk curve.

And the GCC is not immune. SAMA, CBUAE, and the Qatar Central Bank all expect IFRS 9 ECL model validation to meet standards that most bank risk teams are still building toward. What a Big Four reviewer actually flags during an ECL audit is different from what most internal teams prepare for.

What this article covers:

• The five areas auditors check in every ECL model validation
• Pass vs. red flag examples for each area
• The most common deficiencies in GCC ECL models and how to fix them

Prima Consulting’s ECL advisory team has walked banks through pre-audit readiness reviews across Saudi Arabia, the UAE, and Pakistan. What you’re reading is the pattern we see — not a theoretical checklist.

See how Prima’s ECL model review team prepares GCC banks for Big Four audits: ECL Modelling and Validation Services →

Area 1 — Model Governance and Documentation

Here’s something most banks get wrong: they treat governance documentation as a box to tick after the model is built. Auditors treat it as the primary evidence that your model is controlled and independently reviewable. The documentation is not supporting material. It is the audit.

A Big Four reviewer will ask for your model risk policy, your model inventory, and the version history of every assumption change made in the past 12 months. If those don’t exist as structured, dated records, not slide decks or email threads, you’re already in a difficult conversation.

What Passes an Audit

• A formal model risk policy aligned to your central bank’s guidance (SAMA’s or CBUAE’s model risk frameworks map closely to the PRA’s SS1/23)
• A model inventory that lists every ECL model in production, who owns it, when it was last validated, and its current status
• Independent validation completed by a function with no development responsibility for the model
• Dated, version-controlled records of all methodology changes

What Raises a Red Flag

• Validation performed by the same team that built the model
• No formal model inventory or one that was last updated more than 12 months ago
• Model assumptions changed outside a documented change-management process
• Governance documents that describe how the process should work but contain no evidence it actually ran that way

The IFRS 9 standard does not mandate a specific governance structure — but auditors follow ISA 540 on accounting estimates, and that standard demands evidence of management oversight and expert challenge. Without a documented challenge process, the auditor has no way to verify that your model outputs were reviewed critically before they hit the financial statements.

Area 2 — PD, LGD, and EAD Methodology Review

You might think the PD/LGD/EAD methodology section is where the quants win. It’s not. It’s where poor documentation gets exposed. The math can be right and the audit can still fail — because there’s no audit trail showing how the math was checked.

Auditors reviewing PD LGD EAD IFRS 9 methodology want to see three things: that your component models are independently validated, that calibration was tested against realized outcomes, and that the methodology is documented clearly enough for someone outside your team to reproduce your numbers.

That last point is harder than it sounds. The PRA’s September 2025 guidance specifically noted that auditors request the exact data snapshot used for the reported period — and it must be immutable and archived so re-execution produces identical allowances. Most GCC banks are not there yet.

The Kolmogorov-Smirnov and Gini Coefficient Tests

For PD models, auditors expect discriminatory power tests — the Kolmogorov-Smirnov (KS) test and Gini coefficient are the two most common. A KS statistic below 0.25 on a retail portfolio is weak. A Gini below 40% for a corporate portfolio is worse. These are not just benchmarks. They’re the difference between a clean audit opinion and a material weakness finding.

But here’s what most banks miss: auditors don’t just check the aggregate Gini. They check rank stability across vintages. A model with a strong aggregate Gini that falls apart on 2022-2023 origination vintages tells an auditor that something changed in your lending population that your model didn’t catch. That’s a conversation you don’t want to have in November when your year-end is December.

Red Flags Auditors Flag Every Cycle

• PD models calibrated on through-the-cycle data without a point-in-time adjustment for current conditions
• LGD estimates that assume recovery rates from 2018-2020 without challenging whether those rates hold in today’s interest rate environment
• EAD models that haven’t been updated since initial IFRS 9 adoption — particularly for revolving credit facilities
• No Population Stability Index (PSI) check to confirm the validation sample is still representative of the current portfolio

The IFRS 9 validation framework published in the International Journal of Business and Management Invention requires ECL back-testing at both portfolio and grade level — relative and absolute errors analyzed separately, collective and individual ECL assessed independently. Most GCC bank validation reports we review stop at the portfolio level. That’s half the work.

Area 3 — Forward-Looking Overlay Rationale

This is the area where subjectivity enters — and where auditors concentrate the most challenge. Forward-looking overlays are necessary under IFRS 9. But “necessary” and “defensible” are not the same thing.

The ECB’s 2024 review of 51 supervised banks found that many institutions’ Stage 2 classifications did not reflect the actual risks driving their ECL overlay positions — leading the ECB to conclude that insufficient risk coverage was systemic, not isolated. That same pattern shows up in GCC bank audits.

What Good Overlay Documentation Looks Like

A defensible forward-looking overlay starts with a scenario decomposition table. You need to show the percentage contribution of your baseline, upside, and downside macro scenarios to the total allowance — and you need to show the probability weights assigned to each scenario, with a rationale for why those weights were chosen at this specific reporting date.

Auditors under ISA 540 will challenge the macro variables used. For GCC banks, oil price assumptions are always in scope. A UAE corporate portfolio without an oil price sensitivity analysis in its overlay rationale is not ready for a Big Four review. Full stop.

Where GCC Banks Struggle Most

Two patterns repeat. First, overlays applied at the total ECL level rather than at the component level — which the ECB explicitly called out as not in line with IFRS 9 principles. Second, overlay rationale documents that describe the economic risk in detail but fail to show the quantitative link between that risk and the ECL adjustment figure. A narrative is not a rationale. The math has to be there.

Understanding the mechanics of 12-month ECL vs lifetime ECL and how macro overlays interact with stage allocation is foundational here. Get that wrong and the overlay just adds noise to an already imprecise number.

Area 4 — ECL Backtesting and Benchmarking Results

Here’s the counterintuitive part: good backtesting results don’t always help your audit. Poor backtesting results, documented and explained, often do more for your credibility than clean results with no supporting analysis.

Auditors know your model will not be perfect. What they’re testing is whether you know where it’s imperfect — and whether you’ve built a process to catch performance deterioration before it becomes a provision surprise.

Portfolio-Level vs. Grade-Level Backtesting

ECL backtesting for expected credit loss IFRS 9 must run at both levels. Portfolio-level back-tests compare predicted lifetime losses at origination against realized defaults over equivalent horizons. Grade-level back-tests check whether the relative ordering of risk predictions held true — did the high-PD segment actually default more than the low-PD segment?

Many banks produce portfolio-level results because they’re easier to run and easier to present. Grade-level back-tests require more data and more time. They’re also the tests that expose the most common PD model failure: a model that correctly ranks risk at origination but whose ranking drifts as loans age into later stages.

The Challenger Model Question

Auditors increasingly ask whether you ran a challenger model alongside your production model. A challenger model is a simplified alternative — sometimes a provision matrix, sometimes a logistic regression — that produces an independent ECL estimate you can compare against your main model’s output.

If your production model produces an ECL that is 40% higher than your challenger model’s estimate and you don’t have a documented explanation for that gap, you have a problem. Not because 40% is necessarily wrong — but because you can’t tell the auditor why.

“After we ran a pre-audit ECL validation review for a mid-sized UAE bank in 2024, their Big Four auditor raised zero material findings on backtesting — down from four in the prior year.” — Prima Consulting ECL Advisory Team. About Prima Consulting

Area 5 — Management Overlay Justification

Post-model adjustments (PMAs) — sometimes called management overlays — are the most scrutinized part of any ECL audit. And yet they’re also the part most banks document least carefully. That combination is a problem.

KPMG’s 2025 analysis of IFRS 9 PMA practices found that inconsistent application and varying criteria across teams continue to create discrepancies in risk assessments and provisioning estimates. The PRA called out the same issue. So did Deloitte’s 2024 IFRS 9 feedback summary. This is not a niche observation — it’s the consensus view of every major accounting firm with visibility into UK and European bank ECL audits.

What Auditors Want to See on PMAs

Three things: a documented rationale that explains why the model failed to capture a specific risk, a quantitative link between that rationale and the PMA amount, and a defined sunset clause or review trigger that will remove or recalibrate the adjustment when conditions change.

The third one is almost always missing. PMAs applied during COVID-19 were still on some banks’ books in 2024 without a review having taken place. That’s not a judgment call. That’s a governance failure.

The Governance Gap That Kills PMA Credibility

4most’s October 2025 analysis put it clearly: many portfolios still lack a mature link from emerging risks to ECL calculations, which undermines the ability to present a coherent ECL narrative to boards and auditors. That’s the real issue. It’s not the math. It’s the story the math tells — and whether the governance trail proves someone challenged that story before it went into the financial statements.

On the question of what IFRS 9 vs IAS 39 changed on management overlays: IFRS 9 vs IAS 39 shifted the burden from incurred-loss triggers to forward-looking judgment. That forward-looking judgment now needs to be justified, documented, and challenged. Under IAS 39, you waited for evidence. Under IFRS 9, you’re expected to get ahead of it — and prove you did.

The ECL Model Validation Checklist (Auditor View)

Common ECL Model Deficiencies Prima Sees in GCC Banks

This is not a generic list. What follows is based on pre-audit reviews and model risk advisory work across Saudi Arabia, the UAE, and Pakistan. I’m naming the patterns because they keep coming up — and most of them are fixable in 60 to 90 days if you start now.

1. Stale LGD assumptions.

The most common issue, full stop. LGD models built at IFRS 9 adoption in 2018 or 2019 that have not been recalibrated for the current interest rate environment. Recovery rates assumed from a low-rate, high-liquidity era don’t hold when real estate values fall and workout timelines extend. The PRA explicitly flagged this for LGD review and challenge on vulnerable sectors. GCC banks with real estate and construction exposure need to check this now.

2. No model operating boundaries.

Your ECL model was built on data from a specific economic range. What happens when macro conditions go outside that range? Most GCC banks don’t have a documented answer. SS1/23 — the PRA’s model risk management supervisory statement — requires clearly defined operating boundaries for all models. SAMA and CBUAE are moving in the same direction.

3. Forward-looking scenarios that recycle last year’s weights.

A meaningful IFRS 9 forward-looking analysis requires scenario weights to change at each reporting date based on current conditions. Banks that carry over the same three scenarios with the same probability weights from Q4 2023 through Q4 2024 are not applying genuine forward-looking judgment. Auditors notice — especially when the macro environment shifted materially in between.

4. SICR documentation that can’t survive scrutiny.

Understanding the mechanics of ECL stages IFRS 9 is foundational here. Significant Increase in Credit Risk (SICR) triggers must be documented explicitly before year-end. Banks that rely on 30-days-past-due as their only SICR backstop — without qualitative triggers — will draw challenge. The 2024 State Bank of Pakistan inspections focused heavily on SICR documentation quality. Expect SAMA and CBUAE to follow.

5. IFRS 9 software that can’t produce reproducible outputs.

If your IFRS 9 software can’t reproduce last quarter’s ECL from an archived data snapshot, you don’t have a reproducibility problem. You have an audit problem. Auditors request exactly this as part of ECL procedure. Build the archiving process now, not after the request lands.

The IFRS 9 expected credit loss framework gives banks significant judgment. But the PRA, ECB, and GCC central banks are all moving toward tighter scrutiny of how that judgment is applied and documented. Judgment without documentation is not defensible. It’s just a number with a story.

What You Now Know

ECL model validation IFRS 9 is not a once-a-year exercise. The good news: the 5 area framework in this article is a usable starting point. You can run an internal gap assessment against it before your next audit cycle. If you find gaps, and most banks do on at least 2 of the 5 areas, the remediation steps are known. They’re not easy, but they’re not mysterious. The IFRS 9 impairment calculation methodology is well-documented. The governance requirements are well-documented. What’s missing in most banks is the structured effort to close the gap between knowing what’s required and proving you’ve done it.

See how Prima’s ECL Validation team closes audit gaps for GCC banks →

Prima Consulting has supported pre-audit ECL readiness reviews across Saudi Arabia, UAE, and Pakistan. Our team includes actuaries, CPAs, and credit risk specialists who have built and validated ECL models that passed Big Four reviews with zero material findings.

Take our 5-question ECL Audit Readiness Assessment: Email info@primaconsulting.org with subject line “ECL Readiness.”

Frequently Asked Questions

What does ECL model validation under IFRS 9 involve?

ECL model validation under IFRS 9 involves independently reviewing your PD, LGD, and EAD models for discriminatory power and calibration accuracy, testing backtesting results at portfolio and grade level, checking forward-looking overlay rationale, and confirming that model governance documentation meets your regulator’s standards. It’s not a single test — it’s a structured review across five areas.

What do auditors check in an ECL model audit?

Auditors check model governance records, the independence of your validation function, the statistical performance of your PD and LGD models, the rationale and quantitative logic behind management overlays, and whether your IFRS 9 software can reproduce prior period ECL outputs from archived data. Documentation quality is as important as model accuracy.

How often should an ECL model be validated?

Independent validation should occur at least annually. But model monitoring, tracking performance metrics like PSI, KS statistics, and provision coverage ratios against actual loss outcomes, should be continuous. The PRA’s 2025 thematic feedback made clear that annual-only validation cycles are not sufficient for banks operating in uncertain macro environments.

What are the most common ECL model validation failures in GCC banks?

The most common failures are stale LGD assumptions not updated since IFRS 9 adoption, forward-looking scenarios with recycled probability weights, missing model operating boundaries, SICR criteria that rely solely on the 30-days-past-due backstop, and ECL software that cannot reproduce prior period outputs for audit purposes.

What is a challenger model in ECL validation?

A challenger model is a simplified alternative model, such as a provision matrix or basic regression, that produces an independent ECL estimate. Auditors use it to benchmark your production model’s output. If the gap between the two models is large and unexplained, it raises questions about whether your production model is appropriately calibrated for the current portfolio.