The best part of the the FDIC's most current Supervisory Insights is a one page example "Step-by-Step Process for Performing an In-House Independent Review of an IRR Management System." I've extracted a copy of the page and linked to it below.
As far as model validation goes the biggest question has always been, who can conduct the review? Can someone at the bank do it? What about our external auditor? Do we have to hire a consultant? etc. I think the FDIC fairly answers this question:
...there is no one right way to conduct such an independent review. Community banks have conducted these reviews by relying on internal audit staff, bank employees independent of the IRR management process, or third-party consultants. Importantly, there is no requirement or expectation for a bank to hire a consultant, and most community banks should be able to identify an existing qualified employee or board member to periodically conduct this review. Any bank personnel with sufficient training and expertise can perform the review, provided they are not directly involved in the IRR measurement process and are otherwise independent of supervisory personnel responsible for IRR oversight.
FDIC Supervisory Insights - Winter 2014 | p25
I think most community banks can develop an adequate process for doing this in-house. There are two key elements of a successful In-House Independent Review. First, identify the correct person. They should have at least a rudimentary knowledge of accounting and finance - without it the review will devolve into a checklist exercise. Second, know what to look for and evaluate. Fortunately the FDIC has provided this very useful "Step-by-Step" list.