Does internal audit need to reperform model validation during a model risk audit?

Usually not in full. Internal audit should evaluate whether validation was independent, competent, risk-based, sufficiently documented, and acted on. It may perform targeted challenge work over high-risk assumptions, data, performance metrics, or unresolved findings, especially when the model is material or regulatory attention is high.

Reperforming the entire validator's work can blur roles and waste audit effort. A better audit approach is to test whether validation standards exist, whether the sampled model complied with them, whether exceptions were escalated, and whether the business used the model within approved limitations.

If the audit team lacks the technical skill to challenge the validation evidence, it should obtain specialist support. Avoiding the technical risk is weaker than resourcing the engagement properly.