Frequently Asked Questions

Work backward from what an examiner will ask you to prove. For each material control, an institution should be able to name the owner, show the control operating over a period rather than at a point in time, and produce the evidence without a scramble. The preparation that fails is the kind that assembles artifacts reactively in the weeks before an exam, because the gaps it surfaces are too late to fix. Examiners increasingly read submissions for operating discipline rather than for the existence of a document. A policy that does not match how the institution actually operates is worse than a thin policy, because it establishes a standard the institution is then measured against and missing.

A policy states what the institution requires and why, and carries board or executive authority. A standard states the specific requirements that satisfy the policy, such as a minimum configuration or a review frequency. A procedure states how the work is actually performed, step by step, at the operator level. The distinction matters because each tier has a different owner, a different approval path, and a different revision cadence. When institutions collapse the three into one document, ownership becomes ambiguous, every small operational change requires a board-level approval, and examiners cannot tell which statements are commitments and which are descriptions. A clean taxonomy is usually the cheapest documentation fix available.

At minimum: an inventory of the Artificial Intelligence (AI) systems in use or in development, risk tiering so that oversight effort is proportionate to potential impact, a named owner for AI risk inside the existing risk framework rather than a separate structure, defined validation expectations for each tier, monitoring with thresholds set before deployment, and board reporting on a fixed cadence. The National Institute of Standards and Technology (NIST) AI Risk Management Framework organizes this across four functions: Govern, Map, Measure, and Manage. Institutions that want a certifiable management system layer on ISO/IEC 42001, with impact assessments aligned to ISO/IEC 42005. Most institutions already run the governance machinery this requires. The work is connecting AI to it, not building something parallel.

Classify systems by stakes first, then match the yardstick to the class. A generative system used for drafting is measured differently from an agentic system that takes action in a production process. For generative systems, groundedness and hallucination rates against a reference set are the practical measures. For agentic systems, task completion and operational telemetry matter more. Four design decisions separate real measurement from theater: where the thresholds sit, what reference data the metric is computed against, how the metric is composed, and how often monitoring runs. Deciding those after deployment means the first number the board sees has no baseline to compare against.

Not when the project ships. Closure is a claim the institution has to be able to prove to a supervisor after the fact, which means the evidence has to exist independent of the delivery team's own assertion that the work is done. Where a finding was remediated by replacing a system, closure means the new system's population has been reconciled against the source of record after go-live, not that the new system went live. The control that makes this hold is separating the delivery owner from the closure owner, so the person certifying that a finding is resolved is not the person whose project is being certified.

The first line of defense (1LoD) is the business and operational units that own and manage risk directly as part of doing the work. The second line of defense (2LoD) is the risk and compliance functions that set policy, provide oversight, and independently challenge the first line. The wording matters because ownership language written loosely in a policy can quietly assign second line work to the first line, or the reverse. That gap rarely surfaces at implementation, when everyone knows informally who does what. It surfaces months later in an examination or an audit, when nobody can produce evidence of who actually performed the review and under what authority.

Evidence readiness is the state in which the artifacts an examiner or auditor will request are already identified, current, owned, and retrievable on a defined cadence. In practice it means four things are documented for each material control: what the evidence is, where it lives, who owns producing it, and how often it is refreshed. The test is simple. If a request arrives with a short deadline, does the institution retrieve evidence or manufacture it? Institutions that manufacture it under deadline tend to produce artifacts that contradict each other, and the inconsistency itself becomes the finding.

Both, but the governance side is where mid-sized institutions are most often short. The 2026 revision of the National Institute of Standards and Technology (NIST) ransomware profile maps ransomware onto Cybersecurity Framework 2.0, including its Govern function, which puts ownership, oversight, and reporting on the same footing as technical controls. The practical implications are that recovery has to be evidenced rather than assumed, third-party and vendor exposure has to be governed with the same rigor as internal systems, and regulatory notification timing has to be understood before an incident rather than during one.

Across 2025 and 2026 the Office of the Comptroller of the Currency (OCC), the Federal Deposit Insurance Corporation (FDIC), and the National Credit Union Administration (NCUA) independently moved toward a governance-driven supervisory model, and the Securities and Exchange Commission (SEC) and the Financial Industry Regulatory Authority (FINRA) began asking comparable questions of broker-dealers. The common misreading is to treat a lighter procedural touch as relief. It is closer to the opposite: with fewer prescriptive checkpoints, the institution's own governance becomes the thing being examined, and weak ownership or thin evidence has less procedure to hide behind.

Yes. Reputation risk was removed from the supervisory rating framework, not from the business. The removal is a useful test of whether an institution's governance was real or exam-driven. Programs that existed because a rating required them will quietly stop, and the exposure will go unwatched until a name becomes a liability. Programs that existed because the risk is real will keep an owner, keep a measure, and keep reporting it to the board without an examiner prompting the question. Institutions should decide deliberately which of the two they are, rather than discovering it by default.

The 2026 revision to interagency model risk management guidance lifted the model risk overlay on Bank Secrecy Act and anti-money laundering (BSA/AML) systems for most institutions. The independent validation expectation in the Federal Financial Institutions Examination Council (FFIEC) BSA/AML examination manual did not move with it. The practical answer is that the framework the validation sits under changed, while the obligation to demonstrate the system detects what it is supposed to detect did not. Buying the system from a vendor does not transfer that obligation. Tuning, coverage of the transaction population, and exception handling remain the institution's to evidence.