Retail credit. Cannot stop in time.
A redacted example of the AGDA™ output: one material model, one trigger scenario, one signed verdict. Detection works. Authority does not. The organisation cannot intervene before the harm window closes.
- Deterministic
- Signed
- Independently verifiable
The assessed system. The intervention question.
A retail credit decisioning model approving up to 18,000 unsecured applications per day. Identified as material under the bank's internal model risk taxonomy.
- System ID
- CRED-MOD-04Retail Credit Decisioning
- Materiality
- Tier 1internal taxonomy
- Decision authority
- Approve / decline / referno human override on auto-decline
- Volume
- ~18,000 / dayUK personal lending
- Trigger scenario
- Macro shock + model driftsimultaneous
- Reversibility window
- ~6 hoursbefore regulatory disclosure threshold
Intervention Readiness evidence.
Six controls assessed against the eight AGDA™ dimensions. Classification reflects what the control can do under stress, not what the policy promises. Governance is visible; intervention capability is measured.
| Code | Control | Assessment | Terminal |
|---|---|---|---|
| C-01 | Real-time decision logging | Production-grade. Stress-validated against 2024 outage. Detection capability strong; surface latency under 90s. | GREEN |
| C-02 | Drift monitoring (PSI / KS) | Operational in production. Threshold tuning not re-validated since model retrain in 2025-Q3. Caps at amber under evidence rule. | AMBER |
| C-03 | Escalation to MRC | Documented in policy. One tabletop in 2024-Q4. Has not run live. Authority pathway terminates at a forum that meets monthly. | RED |
| C-04 | Halt authority | Three named approvers. None authorised to halt unilaterally. Quorum required. No on-call rota. Weekend gap. | RED |
| C-05 | Manual override on auto-decline | Designed-out. No human-in-the-loop on the high-volume decline path. Reversibility limited to next-day reprocessing. | RED |
| C-06 | Audit trail | Immutable, hashed, retained 7 years. Decision rationale captured per inference. Auditable to regulator standard. | AMBER |
The chain breaks at escalation.
Detection works. The signal exists. Surface is fast. Audit trail is sound. The break is between detection and authority. The path passes through a forum that meets monthly.
- Assessment
- Structural failure
- Gate status
- Not viable
- Timing
- Authority lag above window
- Terminal
- RED · capped
Failure mode FM-12. Authority Lag. The signal reaches the Model Risk Committee. The Committee meets monthly. The reversibility window for the trigger scenario is approximately six hours. There is no out-of-cycle convening authority. There is no on-call halt authority below MRC level. The pathway from detection to halt cannot complete inside the window.
Stage by stage. Against the clock.
- Detect ~12 min to detect drift above threshold PASS · margin 5h 48m
- Escalate ≥ 7 days to next MRC. No out-of-cycle. FAIL · above window ×28
- Decide N/A gated upstream. Quorum unavailable. FAIL · capped
- Intervene N/A no halt authority outside MRC quorum. FAIL · capped
Gate register.
Every temporal gate the chain must clear, with the measured value and the verdict against the reversibility window.
| Gate | Description | Measured | Verdict |
|---|---|---|---|
| G-01 | Drift signal generation latency | ~12 min | PASS |
| G-02 | Signal surfaces to first responder | ~38 min | MARGIN |
| G-03 | First responder reaches authority holder | variable · 4 to 96h | FAIL |
| G-04 | Authority holder reaches quorum | ≥ 7 days | FAIL |
| G-05 | Quorum decision recorded | monthly cadence | FAIL |
| G-06 | Halt instruction propagated to system | ~6 min (if instructed) | PASS |
What the board needs to act on.
The system is well-instrumented at the technical layer. The authority structure surrounding it cannot exercise control inside the window. This is an Intervention Readiness defect, not a model defect.
Can CRED-MOD-04 be halted within six hours of a material drift event today?
No. The fastest credible halt path under current arrangements is approximately seven days. The Board should be aware that the model's PRA SS1/23 §6 intervention capability rating cannot be supported above amber until the authority structure is restructured to permit out-of-cycle halt.
- Establish a named on-call halt authority with unilateral power to suspend CRED-MOD-04 between MRC sittings, with audit trail. Owner: CRO.
- Re-validate drift threshold tuning under stress conditions before the next regulatory submission. Owner: Head of Model Risk.
- Add a reversibility mechanism on the auto-decline path. Same-day reprocessing rather than next-day. Owner: COO.
- Re-scope the quorum requirement for material model halt. Consider standing delegated authority to a single senior named approver. Owner: Board / Remuneration and Governance Committee.
Regulatory mapping.
Where each finding sits against article-level obligations. Regulatory emphasis on effective human oversight reinforces the importance of Intervention Readiness; it does not make the verdict a certification.
| Framework | Article / Obligation | Status |
|---|---|---|
| PRA SS1/23 | §6. Intervention capability proportionate to model materiality | EXPOSED |
| PRA SS1/23 | §4.3. Senior management accountability for model risk | PARTIAL |
| FCA SMCR | SMF4 / SMF24. Allocation of responsibility for halt authority | EXPOSED |
| EU AI Act | Art. 14. Human oversight (capability to interrupt) | EXPOSED |
| EU AI Act | Art. 9. Risk management (residual risk acceptance) | PARTIAL |
| DORA | Art. 6. ICT risk management framework | ALIGNED |
Framework pressure. Where the weight concentrates.
- PRA SS1/23 §6 9.2 CRITICAL
- EU AI Act Art. 14 8.6 CRITICAL
- FCA SMCR SMF4 / 24 7.8 HIGH
- PRA SS1/23 §4.3 5.4 MODERATE
- EU AI Act Art. 9 4.2 MODERATE
- DORA Art. 6 1.8 LOW
Irreversibility profile.
The cost of failing to intervene, and the cost of intervening incorrectly. Both are bounded. Neither is small.
- Time to reversal ~6 hours
Before disclosure threshold under PRA / FCA notification requirements is crossed. Beyond this, intervention shifts from operational halt to regulatory remediation.
- Cost of mis-intervention £2.4 to 4.1M
Revenue impact of a 24-hour halt in error during peak season. Material but recoverable. Orders of magnitude below the cost of a non-halt during a true drift event.
CRR terminals.
Three terminal classifications concentrated on authority. Each explains why the rating cannot be raised by remediation that does not address the underlying authority structure.
- T-04 · RED
Authority lag above window.
The pathway from detection to halt instruction passes through a forum whose convening cadence exceeds the reversibility window. Cannot be remediated by faster signal.
- T-07 · RED
Quorum unavailable on call.
Halt authority requires a quorum. No out-of-hours rota exists. No individual is authorised to act unilaterally. Structural, not procedural.
- T-09 · RED
Reversibility designed-out.
Auto-decline path lacks an in-window reversal mechanism. Intervention is bounded by next-day reprocessing, not real-time correction.
- T-02 · AMBER
Threshold tuning not re-validated.
Drift thresholds inherited from prior model version. Acceptable interim. Falls to red if next retrain ships without re-validation.
Evidence register.
Lowest-grade evidence in a dimension caps the dimension. Listed in evidence-grade order, lowest first.
| ID | Description | Type | Grade |
|---|---|---|---|
| E-12 | "On-call halt authority exists." Stated in interview, no document. | Verbal | G0 · Assumed |
| E-08 | MRC charter naming halt authority. | Document | G1 · Policy |
| E-04 | Tabletop exercise minutes, 2024-Q4. | Drill | G2 · Drill |
| E-02 | Production drift monitoring runtime logs (12 months). | Operational | G3 · Production |
| E-01 | 2024 outage post-mortem with timing telemetry. | Stress | G4 · Stress-validated |
| E-06 | Hashed audit log sample, regulator-format export. | Stress | G4 · Stress-validated |
Modelled exposure if the chain does not hold.
Quantified consequence of the trigger scenario reaching the disclosure threshold without intervention. Drawn from the bank's own materiality matrix.
If detection-to-halt does not complete inside six hours.
- Decisions exposed ~108k over six-hour window
- Notification trigger PRA / FCA disclosure threshold crossed
- Estimated remediation cost £14 to 22M three-year horizon
The single-line verdict for the audit committee.
The verdict the chair is being asked to rely on. Not a recommendation. A measurement.
Detect, escalate, decide, intervene does not complete inside the reversibility window.
Detection capability is sound. Authority capability is not. Until the halt-authority structure is restructured to permit out-of-cycle action, PRA SS1/23 §6 intervention capability cannot be supported above amber. Submitting it as evidence of §6 compliance would misrepresent the actual capability.
Driven by chain-ceiling propagation. Detect measures 4.0 but Escalate caps at 1.25, capping all downstream stages. Average is misleading. The chain is the control.
A board that cannot intervene is not a safeguard. It is a witness.
Run this against your own system.
The format on this page is the format your audit committee would receive. Same engine, same calibration, same attestation, applied to one of your material systems.