The lending domain received central approval and celebrated the transfer. “Risk approved it” became the answer to every question about customer consequences. Three months later, complaints revealed adverse decisions that neither the model dashboard nor the approval record could identify by case.

The approval was real. The transfer was imaginary. The central function had no authority over the underwriting workflow, no contact with affected customers, no remediation budget and no ability to suspend lending. The domain controlled the context that produced the outcome but treated challenge as ownership.

The risk of an AI-enabled decision is produced where evidence, model output, human judgement, authority and action combine. It cannot be assigned to an AI team, model-risk function, vendor or committee that does not control that production context. Activities and expertise can be delegated. Informed accountability for the consequence cannot.

The first-line owner of the business outcome therefore owns its associated risk within appetite. That includes adoption, exceptions, overrides, downstream state changes, complaints, incidents, benefit and harm trade-offs, remediation and retirement. Ownership is not doing every control. It is having enough information, real authority, resources and stop capability to answer for the result.

Independent risk and assurance remain essential. Specialist ownership is the strong rival because AI risks can be technical, unfamiliar and shared. A central function should own taxonomy, methods, aggregated exposure and qualified challenge. It should not own the operating outcome when it cannot change users, workflow, customer treatment or recovery.

This article’s AI outcome-risk custody chain follows seven objects from intended decision to observed consequence and remediation. A custody break exists wherever the named owner cannot see, control, finance or stop a material link. The test turns first-line ownership from a slogan into an operating proof.

Original synthesisFollow seven objects from intent to recovery

The chain begins with a decision, not a model. A model may rank, retrieve, predict, generate or recommend, but risk ownership attaches to the business action and affected population. Naming the intended outcome prevents a team from optimising model performance while the workflow produces an unacceptable consequence.

The population object includes people who do not appear in the training or inference records. A household member, employee, supplier or community may be affected by a decision made about someone else. Segmentation identifies where average performance conceals concentrated harm and which cases require additional evidence or review.

The evidence object states the model’s contribution rather than attributing the whole decision to it. Input provenance, uncertainty, validation scope and known limits are joined to policy and non-model evidence. A first-line owner need not build the model, but must understand enough to decide whether its contribution is admissible in this workflow.

Human review is a risk-bearing component, not a decorative control. Override patterns can reveal poor thresholds, automation bias, workload pressure or local learning. The owner sees override reason, frequency, affected population and downstream effect, and can change staffing, policy or interface when the control stops working.

The action object makes consequence concrete. A recommendation becomes consequential when it changes credit, price, service, access, investigation, communication or another state. The contract records reversibility, notice, appeal and system-of-record changes so that a later incident can find affected cases.

Observed effects extend beyond model metrics. Complaints, abandoned journeys, rework, manual correction, appeals and delayed service may live in different systems. The owner joins them to the decision population and model version. Benefit evidence travels through the same chain, preventing a domain from claiming upside while transferring downside.

The final object makes custody expensive enough to be real. Remediation requires trained people, customer communication, authority to reverse state and a budget. Stop and retirement require operating alternatives and evidence preservation. A paper owner without these resources is a reporting convenience, not an accountable owner.

The IIA’s Three Lines Model distinguishes governing-body accountability, management action and independent internal assurance.[1] Its Global Internal Audit Standards protect objectivity and govern coordination with other assurance providers.[2] The chain uses those distinctions while keeping the operating consequence with management’s first line.

Custody-break testProve information, authority, resources and stop capability

A custody break occurs whenever the owner cannot see, control, finance or stop a material link. All four conditions matter. Information without authority creates an informed spectator. Authority without evidence creates arbitrary control. Responsibility without resources creates a paper owner. A stop right without a viable operating path may be unusable when pressure arrives.

Information means access to the evidence needed to understand current exposure and investigate affected cases. It includes model and prompt version, input and output lineage, override, downstream action, complaint, correction and control performance. Dashboards are insufficient when they aggregate away the affected population.

Real authority means the ability to change workflow, policy, configuration, threshold, staffing, human review and customer treatment within a defined delegation. Formal accountability with decisions retained elsewhere is a custody break. Research on formal and real authority explains how actual control can diverge from allocated rights.[12]

Resources cover ordinary control work and adverse response. The owner has people, time, technology and budget for monitoring, case investigation, remediation, compensation, recovery and retirement. A risk acceptance that assumes another team will somehow finance failure understates exposure.

Stop capability includes authority, an observable trigger, a technically effective control and an operational fallback. It can pause a model contribution, a workflow stage or the complete business activity at the appropriate scope. Restart requires evidence that the relevant service and outcome conditions have recovered.

Federal Reserve, OCC and FDIC model-risk guidance calls for clear accountability, effective challenge, validation, vendor oversight and internal-audit independence.[3] The custody test applies those distinctions to the full outcome path. Model ownership and outcome ownership can be different, but the handoff between them must not make affected cases untraceable.

Basel corporate-governance principles place responsibilities with boards and senior management while emphasising risk governance and control functions.[4] The named first-line owner operates within those delegations and constraints. Escalation occurs when exposure exceeds its authority or becomes common across business lines.

Use failure controls before accepting a signature

Approval transfer fails the authority test in reverse. The domain still controls the workflow but speaks as though a central approval moved the consequence. Record what the approval actually did: confirmed a constraint, accepted specified evidence, raised no objection or exercised a delegated right. None of those acts replaces the outcome receipt.

Paper ownership fails when an executive appears on an accountability matrix but cannot inspect case evidence, change the operating path or commit remediation funds. Seniority can provide escalation and sponsorship, yet real custody needs an operational delegation. The executive either receives the missing authority and information or assigns a suitably empowered owner while retaining oversight.

Informed signature matters because specific knowledge is expensive to transfer. Jensen and Meckling connect the location of knowledge with the allocation of decision rights.[11] A domain owner need not reproduce specialist validation, but must understand the conclusion, limitations, workflow relevance and unresolved exposure well enough to make the permitted operating choice.

Risk as designer fails the independence test. If second line temporarily supplies operating expertise, the arrangement names a time limit, conflict safeguard and transfer plan. First line develops competence and re-ratifies the design. Until separation is restored, later challenge cannot be represented as fully independent.

Vendor custody fails when the deployer receives aggregate model health but cannot identify which cases used an affected version or reverse the resulting state. Procurement assurance and supplier certification cannot repair missing case lineage. The workflow pauses or narrows until investigation, change, support, stop and exit rights are usable.

Invisible harm fails the information test when complaints, rework or adverse decisions sit outside product telemetry. The owner maps those systems, defines a lawful join and assigns response time. Where a direct join is inappropriate, sampled review or controlled linkage still tests whether the apparently healthy model supports acceptable field outcomes.

Benefit without downside fails the resource test. A product cannot claim faster cycle time and avoided cost while treating compensation, manual correction and retirement as central risk expenses. The same owner signs benefit assumptions and response capacity, allowing finance and the governing body to see the complete trade-off.

Independence by designKeep operating ownership inside challenge, not underneath it

First-line ownership sits at the centre because it shapes the workflow, chooses operating trade-offs and receives field effects. Second-line risk surrounds that work with appetite, interpretation, monitoring, challenge and escalation. Third-line audit forms an independent outer test of governance, design and performance. The layers exchange evidence without sharing the same decision.

Risk as designer is a common custody failure. A second-line specialist chooses the threshold and override rule because the domain lacks expertise, then later declares those choices acceptable. The workflow may improve in the short term, but independent challenge has been weakened and first-line learning has been postponed.

Specialists can advise, propose methods and explain constraints. The first line selects the operating design within appetite and signs the outcome-risk receipt. If risk exercises a binding veto under delegated authority, it records the condition and object, while outcome ownership remains with the first line. If the first line lacks competence to choose, the answer is capability repair or a stop, not concealed transfer.

Third-line assurance should not become a standing approval gate. It evaluates whether governance, risk management and controls are designed and operating effectively, with access and independence protected by standards. Its findings can compel management attention through governing-body authority without making audit the workflow owner.

Separation of decision management from decision control provides an organisational basis for allocating initiation, ratification, implementation and monitoring.[13] In an AI workflow, those functions may be distributed, but every split must preserve a complete chain from real authority to observed consequence.

Formal risk systems can create an appearance of control while shifting attention towards auditable representations rather than uncertainty in practice.[14] The custody chain resists that tendency by joining risk records to affected cases, field signals and funded remediation, not merely to assessments and committee minutes.

Aggregate ownership begins where a domain delegation ends. Enterprise risk may see concentration across models, vendors, data sources or customer populations that no individual workflow owner can observe. It aggregates receipts, challenges the common exposure and routes it to an authority capable of constraining several domains. Local owners still contain and remediate their cases. Escalation adds a higher-order risk object; it does not erase the custody chains that produced the exposure.

The governing body receives a decision-ready view: affected outcomes, concentration, tolerance movement, control performance, plausible response cost and choices for containment. It does not receive a list of model scores detached from business actions. This makes common-mode intervention possible while preserving the information and authority closest to each consequence.

Delegated activityPreserve deployer custody through vendors and shared services

A vendor can operate a model, evaluation service, data pipeline or complete application without owning the deployer’s outcome. The supplier controls its service and must meet contractual, security, performance and evidence obligations. The first-line deployer still chooses the workflow, affected population, customer treatment and continued use.

The vendor custody break appears when model telemetry exists but the deployer cannot reconstruct affected decisions. An incident ticket may show latency and error rate while hiding which applicants received incomplete evidence, which human reviewers saw it and what downstream action followed. Service observability has not become outcome observability.

The dependency contract therefore carries stable identifiers and evidence across the boundary. The deployer can join input provenance, model or prompt version, output, confidence or uncertainty, policy configuration, human action, system-of-record change and later correction. Data minimisation and access controls govern this evidence, but confidentiality cannot become a blanket excuse for uninvestigable consequences.

Change rights also preserve custody. The vendor provides notice, behavioural description, shared regression evidence, version support, staged rollout and rollback where relevant. The deployer decides whether its representative population and workflow remain acceptable. An automatic vendor upgrade that silently changes a consequential decision path is a custody break even when the service contract permits it.

The NIST AI RMF Core connects governance, context mapping, measurement and management across the lifecycle.[6] The Playbook provides voluntary actions that organisations can adapt to their context.[7] A supplier can produce reusable evidence, while the deployer maps and manages the actual affected population and action.

NIST’s Generative AI Profile adds considerations for generative-system risks and actions.[8] Where a shared generator or retrieval service supports several domains, the platform owner monitors common service exposure. Each domain owner monitors whether generated material altered a decision, communication or record in its workflow.

Exit must be executable before concentration grows. The deployer can export configuration, evaluation assets, case lineage, incident history and records required for continuing obligations. It knows how to suspend the dependency, use a fallback and preserve decisions already made. A contract termination clause without evidence portability is commercial exit without risk exit.

Basel operational-resilience principles address critical operations, dependency mapping, third-party relationships, testing and incident management.[5] The custody chain applies the same discipline to AI dependencies: map what the workflow needs, test disruption, identify substitutability and retain authority over customer and operational response.

Field evidenceExtend the telescope beyond scores, latency and control completion

Invisible downstream harm often survives because each system reports only what it can see. The model service reports scores, abstentions and latency. The workflow reports completion. Complaints, appeals, corrections, collections, employee escalation and customer departure live elsewhere. No owner joins the path.

The harm telescope starts with a decision event identifier and widens through action, downstream state, customer or operator response, remediation and recovery. It is not an unrestricted surveillance system. It selects evidence proportionate to consequence and preserves lawful purpose, access, retention and affected-party protections.

Leading signals include missing evidence, confidence movement, override concentration, unusual fallbacks, reviewer disagreement and policy exceptions. Lagging signals include complaints, reversals, rework, losses, delayed service and compensation. Near misses matter because intervention may prevent harm while still revealing a failed decision path.

Aggregate metrics can hide minority exposure. The owner segments by population, product, channel, geography, decision type, version and human-review pattern where lawful and meaningful. It also tracks missingness. An apparently low complaint rate is weak evidence when affected parties cannot recognise, reach or use the complaint route.

The OECD AI Principles call for transparency, robustness, security, safety and accountability.[10] Accountability becomes operational when an owner can trace field effects, explain the decision process at the appropriate level, act on weak signals and show what remediation followed.

Normalised deviance develops when repeated departures produce no immediate visible failure and gradually become accepted practice. Vaughan’s study of the Challenger launch decision shows how organisational routines, signals and production pressures can shape unsafe outcomes.[15] Override, bypass and exception evidence must therefore be read as a pattern, not dismissed one event at a time.

The owner defines incident triggers before launch. A trigger can combine severity, affected population, control failure, repeated override, evidence loss or legal obligation. It activates case preservation, stop or containment, first-line response, independent notification, aggregate escalation and governing-body reporting according to the relevant threshold.

Remediation closes the chain only when the affected state is repaired. Fixing a model or prompt prevents recurrence but does not correct past decisions, restore service, compensate loss or explain treatment. The outcome-risk receipt links technical correction with case-level and aggregate recovery evidence.

Worked applicationKeep lending outcome custody with the workflow owner

A lending product uses a vendor model and shared document platform to support affordability assessment. The workflow owner is accountable for the decision population and customer outcome. Data, technology, operations and risk provide services, constraints and challenge, but none can accept the domain consequence on the owner’s behalf.

The intended decision is whether the available evidence supports a permitted lending action. The population includes applicants, consequential subgroups and existing customers whose later treatment may depend on the result. The owner records expected benefit, prohibited outcomes, appetite, tolerances and rights to explanation, correction and review.

The evidence object joins application data, document provenance, platform retrieval, vendor-model version and uncertainty with policy inputs. Data owners set quality and admissibility constraints. Technology owners provide service and recovery evidence. The workflow owner decides whether the combined evidence supports use in this decision.

Underwriters receive a structured recommendation and source trail. Their override is neither discouraged nor celebrated in isolation. Reason, direction, segment, workload and later case outcome are monitored. A sudden fall in overrides may indicate model improvement, interface pressure or automation bias; ownership requires investigation rather than a preferred interpretation.

The action object covers approval, decline, referral, requested information and any downstream record. The workflow owner controls policy and customer treatment within delegation. Second-line risk independently challenges performance, limits and aggregate exposure. It does not select the day-to-day threshold and then validate its own design.

A complaint about missing income evidence triggers case preservation and review. Stable identifiers reconstruct inputs, retrieved documents, model output, human action and final state. Similar cases are located by version and failure pattern. If exposure crosses tolerance, the owner pauses the affected route and escalates common impact to enterprise risk.

Remediation includes corrected decisions, customer communication, restored records and compensation where required, as well as platform or model repair. The domain owns the case work and budget. Supplier contracts fund or support their obligations, but vendor responsiveness is not the domain’s remediation plan.

European Union AI regulation assigns obligations across providers, deployers and other actors, including risk management, human oversight, quality systems, value-chain responsibilities, deployer duties and post-market monitoring for relevant systems.[9] The custody map does not replace legal classification. It makes the deployer’s operating evidence and authority explicit alongside provider duties.

The signed receipt records the owner, decision, population, appetite, binding constraints, evidence sources, challenge, service dependencies, incident triggers, funding and stop authority. Finance confirms remediation capacity. Operations confirms fallback. Risk signs its challenge, not the business outcome. Audit later tests whether custody worked as represented.

The successful design can still stop. If the vendor removes case-level lineage, if complaint joining fails, if remediation capacity is exhausted or if the owner loses control of the workflow, custody has broken. Continued central approval cannot cure those defects. The route pauses until information, authority, resources and stop capability are complete.

Decision instrumentTest custody before accepting the ownership claim

The Outcome-Risk Ownership Test evaluates a named workflow, affected population and proposed first-line owner. It does not produce a maturity score. It returns an operating route and the exact custody break that prevents credible ownership.

Run it before approval, after material change, during incident review and when a vendor or shared service changes. Involve the proposed owner, operations, technology, data, finance and independent risk. Evidence beats assurances: demonstrate case reconstruction, workflow change, funded remediation, stop execution, aggregate escalation and the signed receipt.

ConclusionPlace ownership where consequence can be changed and repaired

AI outcome risk follows the production of the decision, not the path of the approval. The credible first-line owner controls the workflow and affected outcome while operating within delegated appetite and binding constraints. It can see case and aggregate effects, finance response, stop the relevant scope and retire the dependency.

Central AI, model-risk, compliance and vendor specialists remain indispensable because methods, shared exposure and technical evidence need concentrated expertise. Their contribution becomes stronger when its type is explicit. They supply services, constraints, validation, challenge, monitoring or assurance. They do not become the owner of consequences they cannot govern in practice.

The seven-object chain keeps intent, affected parties, model contribution, human judgement, action, observed effect and remediation in one custody record. The four-part detector rejects paper ownership. The three-line design prevents risk from validating its own workflow choices. Vendor evidence and the harm telescope keep delegation from turning into blindness.

The final question is practical. When the AI-enabled outcome goes wrong, who can find the affected cases, understand the path, stop further consequence, correct the state, communicate with those affected, finance the response and decide whether the workflow should return? That role owns the outcome risk. If no role can do all of it, custody is incomplete and the workflow is not ready to continue.

Source trailReferences

1. The Institute of Internal Auditors (2026), Statement of Position on the Three Lines Model. Official resource.
2. The Institute of Internal Auditors (2024), Global Internal Audit Standards. Official standards.
3. Board of Governors of the Federal Reserve System, OCC and FDIC (2026), Revised Guidance on Model Risk Management, SR 26-2. Official guidance.
4. Basel Committee on Banking Supervision (2015), Corporate governance principles for banks. Official publication.
5. Basel Committee on Banking Supervision (2021), Principles for operational resilience. Official publication.
6. NIST (2023), AI Risk Management Framework Core. Official resource.
7. NIST (2023), AI RMF Playbook. Official resource.
8. NIST (2024), Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile, NIST AI 600-1. DOI.
9. European Union (2024), Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence. Official text.
10. OECD (2024), OECD AI Principles. Official resource.
11. Jensen, M. C. and Meckling, W. H. (1995), ‘Specific and general knowledge, and organizational structure’, Journal of Applied Corporate Finance, 8(2), 4–18. DOI.
12. Aghion, P. and Tirole, J. (1997), ‘Formal and real authority in organizations’, Journal of Political Economy, 105(1), 1–29. DOI.
13. Fama, E. F. and Jensen, M. C. (1983), ‘Separation of ownership and control’, Journal of Law and Economics, 26(2), 301–325. DOI.
14. Power, M. (2007), Organized Uncertainty: Designing a World of Risk Management, Oxford University Press. Publisher record.
15. Vaughan, D. (1996; enlarged edn 2016), The Challenger Launch Decision: Risky Technology, Culture, and Deviance at NASA, University of Chicago Press. Publisher record.