The Problem Isn't Policy. It's Proof.

A UK retail bank does not lack an AI policy. At board level, the CRO can point to frameworks, principles, and control structures. On paper, governance exists.

In practice, decision proof does not.

---

The illusion

From the outside, the system looks under control. Policies define intent. Control frameworks define structure. Documentation is in place, risk maps are signed off, and controls are reviewed quarterly.

---

Where it breaks

The harder question is not whether governance exists. The harder question is whether governance can be demonstrated — not in theory, not in aggregate, but at the moment a single decision is questioned.

---

The shape of the problem

Take an AML monitoring model. On a Wednesday in November the model flags a £42,000 wire transfer to a small business in Cyprus. A Tier-2 alert is raised. An analyst clears it within forty minutes after a phone call to the relationship manager.

The system moves on. The decision disappears.

---

What remains

Eight months later the FCA's S166ⓘA skilled-persons review under section 166 of the Financial Services and Markets Act. The FCA can compel a firm to commission an independent assessment of a specific area — model governance, financial crime controls, conduct — and pays the firm's costs back to itself. review picks the same payment from a sample of 200 and asks why this transfer was cleared.

The first-line risk team looks back and finds the alert ID, the timestamp, the analyst's name, and a free-text comment. Logs of the model run. Events from the case management system. Traces from the audit log.

Fragments of activity.

---

Reconstruction

From those fragments, an explanation is assembled. The input can be found. The outcome can be found.

The reasoning is inferred.

The policy still exists in the policy repo, but the version that applied that Wednesday in November has been superseded twice. The model still exists, but it was retrained in February against a different feature set. Thresholds have shifted. Context has changed. The original decision cannot be reconstructed: the team cannot verify it against policy as it stood at the time of the alert, and they cannot determine whether the criteria the analyst applied were the criteria the policy required.

The answer that goes back to the FCA is produced anyway. Plausible, defensible, and partly invented.

---

The time problem

Governance is not static. Policies evolve, models are retrained, thresholds are adjusted, ownership shifts.

The question that actually gets asked is not what is the policy now? It is what was the policy at the moment this decision was made? — and more importantly, can that be demonstrated?

---

The independence problem

Even when evidence exists, it is rarely independent. The same case management system that recorded the alert produces the explanation. The same model registry that ran the inference reconstructs the reasoning.

This is not proof. It is a system describing its own behaviour. Procedural, not forensic.

---

Why this matters

Day to day, this goes unnoticed. Systems operate. Decisions are made. Outcomes are delivered. Everything appears governed.

Until it isn't.

---

The moment of scrutiny

Governance is tested at a single point: when someone asks why. Why this customer was declined. Why a particular transfer was cleared. The reason this particular loan was approved.

Not in aggregate, not in a dashboard, not in a board pack — in one specific case, on one specific Wednesday in November.

---

The gap

AI governance programmes in tier-one banks focus on better policies, more documentation, and stronger framework alignment.

The failure is not in the policy.

It is in the decision.

---

The shift

Governance lives in decisions, not in policies.

A governed system does not reconstruct decisions later. It captures them at the moment they are made — input, policy, context, and outcome bound together as a single signed artefact. Complete. Deterministic. Verifiable.

---

What changes

When the FCA letter arrives — why did this happen? — there is nothing to rebuild. No stitching together of logs. No inference. No approximation.

The decision can be read.

---

Closing

Policies create intent. Frameworks create structure.

But decisions are where governance actually happens.

If those decisions cannot be proven later, governance does not exist.

Decision Assurance

Governance is what happens at the decision.

Inspect a receipt →