Islamic bank licensees must validate their risk rating or scoring system and ascertain its applicability to their portfolio prior to implementation. An external independent party, other than the external auditor, with necessary expertise in model validation, must conduct the validation of the risk rating/scoring and ECL models every three years and upon development of the model, and also when there are material changes to the portfolio, rating/scoring model or model parameters (See also Paragraph CM-1.2.22 (c)).