Manual Alterations in Agentic Outsourcing

Manual Alteration Requires an Independent Delivery Audit

Respondents reported manual alteration on 100 percent of the study’s engagements: 150 of 150. Yet fewer than 1.3 percent of pooled valid answers to three disclosure questions reported that the respondent or management had discussed the specified alteration with the bank: 13 of 1,004 answers, or 1.29 percent. Figure 1 presents the contrast with its different denominators. It warrants an immediate, independent audit of what people changed, what the bank authorized, and what performance reports represented.¹

The occurrence finding covers five overlapping methods: alteration of bank data, bank processes, AI outputs, reporting, and third-party work performed by hand. The disclosure measure covers only data, process, and output questions. It is a pooled answer rate, with possible repeated people, not the percentage of engagements or unique respondents who informed the bank. The audit must establish communication through records rather than infer the bank’s knowledge from that percentage.

The board should authorize a five-method audit, preserve both firms’ records, and provide protected staff access within applicable rights. The chief audit executive should establish independent assurance while management owns correction. Initial triage should contain material exposure; a 30-day return should reconstruct priority delivery, followed by correction or restriction decisions within a proposed 60–90-day window. Customer or control concerns require action when identified, irrespective of that planning timetable.

Distinguish Necessary Human Work from Uncontrolled or Misrepresented Intervention

Human intervention can protect the bank. Correcting an invalid input, applying professional judgment, or invoking an approved fallback may be necessary to deliver the service. The study includes a data-exception procedure agreed with the bank’s platform owner before correction. This account makes authorization, traceability, competent review, and accurate representation the relevant tests; alteration alone does not establish misconduct.²

Correction records also provide evidence about the system’s limitations. The US NIST’s voluntary AI Risk Management Framework distinguishes human roles and identifies override frequency and rationale as useful information. FINMA’s Swiss supervisory observations similarly identify outputs ignored or changed by users as monitoring evidence that may reveal weaknesses. Recording human contribution supports both appropriate oversight and a more reliable account of agent performance.³

The audit should consequently distinguish outcome quality, compliance with authority and control requirements, and accuracy of reporting. An acceptable outcome may result from an unapproved process, or from authorized human work excluded from automation and cost claims. The response depends on which condition the evidence establishes. Directors need that distinction before accepting claims about quality, autonomy, or savings.

All Five Methods Belong in the Audit

The five methods follow the service from incoming data through delivery and reporting, including external dependencies. Figure 2 identifies their reported occurrence and the evidence needed for examination. Counts overlap and must not be added. Data, process, and output occurrence combine direct answers with written accounts; reporting alteration and third-party handwork rely on written accounts. They describe reported practices, not verified incident totals.⁴

Bank-Provided Data Is Changed Before Agents Use It

Data alteration changes the basis on which the agent acts. Respondents described cleaning, normalizing, rekeying, and patching bank data, sometimes without access to repair the originating system. Compare the bank’s extract with the values loaded for agent use, then determine why material changes occurred and who authorized them. Approved format normalization differs from an unsupported change to a factual value; recurring repair should identify the bank owner responsible for the source defect.⁵

This distinction matters beyond the corrected file. BCG’s agentic data-risk analysis explains how cross-system action can propagate flawed data and unauthorized changes, making provenance and lineage relevant controls. Applied here, the audit should determine where altered values subsequently traveled and whether corrections remained confined to the approved purpose.⁶

Bank Processes Are Changed to Keep Delivery Moving

Process alteration changes how the service reaches its outcome. Respondents described added, substituted, or bypassed steps when documentation, decisions, or authority were unavailable. Reconstruct selected cases against the approved workflow and change record to distinguish authorized continuity measures, accepted redesign awaiting documentation, and unexplained departures. This examination must include unresolved bank decisions: requiring compliance with an unusable procedure will not repair the dependency that produced the workaround.⁷

People Repair or Select AI Outputs

Output alteration changes what the bank receives after agent execution. Accounts included correction of unreliable results and selection between inconsistent runs. Retain the first output, reruns, reviewer changes, and accepted deliverable to establish what the agent produced and what the person contributed. A successful final result can demonstrate effective combined delivery without proving unaided agent reliability. Review, reruns, and correction effort therefore belong in both quality measures and the economic account.⁸

Reporting Can Change the Picture Directors Receive

Reporting alteration can obscure the interventions established by those comparisons. Accounts described activity substituted for outcomes, human-corrected work attributed to agents, and failures excluded from a reported rate. A trade, settlement, and reconciliation contributor described corrected settlement fails entering “the same success bucket as fails the agent resolved on its own.” Rebuild material measures from source cases, including unresolved work, failed attempts, reopened items, and human queues. The test is whether classifications answer the agreed performance question, not merely whether their arithmetic reconciles.⁹

Third-Party Work Is Completed by Hand Inside the Service

Third-party handwork extends the examination beyond the bank and direct provider. Teams described portal retrieval, data entry after feed failures, and repair following unannounced interface changes. Such work may form a necessary manual bridge, but the bank needs its permissions, competence, staffing, cost, and continuity requirements to be explicit. Testing whether another qualified worker can operate the bridge distinguishes controlled fallback from dependence on undocumented individual knowledge. Figure 2 brings these five methods together.¹⁰

Delivery Pressure Can Sustain Unreported Work and Unresolved Defects

The five methods reveal how intervention can sustain delivery while leaving the underlying defect unresolved. Reported reasons included unsuitable inputs, delayed bank decisions, unreliable outputs, and unstable external connections. Some accounts also described pressure to continue processing and management resistance to raising output weaknesses with the client. These mechanisms explain what the audit should investigate; they do not establish intent across the sample.¹¹

The commercial examination should follow the same evidence discipline. Compare pricing assumptions, promised automation, internal targets, and performed work to determine whether incentives rewarded delivery or low reported exception counts without recognizing necessary human effort. Fixed prices and ambitious targets alone establish no impropriety. A supported finding must connect the incentive to an action and the resulting representation.

Visibility is the remaining link between intervention and institutional response. The study describes team trackers, personal notes, partly logged changes, and labor omitted from performance reports; an engagement manager identified a parallel correction sheet the client never saw. Trace material information from delivery staff through management to the bank owner and committee reporting, identifying where an agreed communication or escalation route failed.¹²

The UK FCA’s October 2026 observations warn that excessive reliance on human review can mask model weaknesses. Its discussion of intervention authority and records of review, approval, override, or escalation supports examining the substance of the human contribution. A recorded reviewer’s name cannot show whether correction occurred or whether recurring defects reached an owner able to resolve them.¹³

An Independent Audit Must Reconcile the Service with the Account the Bank Received

An independent audit should reconcile delivery with the account received by the bank. Preserve bank originals, provider-loaded inputs, configurations and action histories, raw outputs, correction records, approvals, communications, invoices, and dashboard definitions. Protected staff evidence should accompany records, with confidentiality bounded by law and the audit arrangements. Sampling should include apparently successful work as well as exceptions and complaints so that routine repair remains visible.

For each selected item, the proposed reconstruction record links original input, agent action, human intervention, accepted outcome, bank communication, and reported result. It records reason, actor, authority, review, customer effect, and cost. Comparing this record across bank, provider, and staff evidence exposes discrepancies that a jointly agreed narrative could otherwise conceal. Unlogged interventions and missing records remain open evidence gaps until supported explanations resolve them.

Communication requires separate verification because prior authorization, later notification, general awareness, and escalation to an empowered person are different events. Establish who received what information, when, and with what authority to accept the practice, then compare that evidence with the contract and applicable duties. Neither the survey’s 13 affirmative answers nor an unsupported assertion that the client knew can establish the complete communication history.

Access arrangements must support that reconstruction before fieldwork begins. DLA Piper’s European-focused procurement analysis recommends aligning contracts with decision logs, override reasons, change information, and suspension capability. Its practical implication is that a compliance warranty is insufficient when the bank cannot obtain the evidence needed to assess oversight. The audit should determine whether promised rights can be exercised in the operating service.¹⁴

Assurance must remain independent of management correction. The US agencies’ nonbinding interagency guidance supports independent review of third-party operating controls, staffing, and information access, while separating board oversight from management implementation. The bank should assign correction to operating owners and closure verification to personnel independent of that work, with unresolved access limitations escalated through the assurance reporting line.¹⁵

Resolve the Intervention, Its Cause, and Its Consequences

Figure 3 connects audit findings to operating decisions. Authorized, recorded correction can remain part of delivery when competence, capacity, cost, and reporting are explicit. Recurring intervention should lead to source correction or a justified decision to retain human work. Bank data and decisions require bank owners; provider practices require provider owners; communication across the boundary requires joint accountability. This allocation prevents a provider-only action plan from leaving institutional defects unresolved.

Correction must also address work already delivered. Management should establish the potentially affected population, assess earlier outcomes, and assign repair, communication, redress, or notification as required. Legal and compliance specialists should assess duties and deadlines when concerns emerge. Changes to dashboards should explain material revisions to the bank’s earlier quality or savings assessment, rather than silently replace the prior account.

Independent closure should demonstrate agreement among the service performed, alteration record, bank communication, and performance measures over a defined period and relevant conditions. Evidence should show retained human effort and a functioning route for staff concerns. If material intervention cannot be explained or bounded, autonomy, volume, or the affected activity should remain restricted until an adequate control or alternative delivery route operates.

Require Evidence Before Accepting the Delivery Account

The board’s decision follows from the contrast: reported alteration on 150 of 150 engagements and only 13 affirmative answers among 1,004 pooled disclosure answers. At the 30-day return, require reconstructed priority cases, discrepancies, customer exposure, access gaps, and containment decisions. Within the proposed 60–90-day window, require funded correction, independently supported closure, or an explicit restriction or continuation decision for unresolved material findings.

The governing question is whether the bank can establish what agents and people did, who authorized it, what was communicated, and how reporting represented the work. Until those elements reconcile, claims about automation, quality, and savings remain assurance claims requiring verification. The independent five-method audit provides the evidence needed to accept or change the delivery arrangement.

Evidence and Source Note

The study records 850 delivery-team respondents on 150 engagements during January–June 2026 in a nonrepresentative, single cross-section. Banks and vendors were not approached for corroboration. The findings establish neither causation nor industry prevalence, verified bank knowledge, legal breach, or a quantified performance overstatement. This paper uses the author-supplied version 1.8.2, dated November 1, 2026, as forthcoming material, with public sources checked through October 23, 2026. External sources provide context rather than validation; the audit record and decision tests are proposed applications.¹⁶

Notes

1. Phil Hatch, Agentic AI Outsourcing at Tier 1 Financial Institutions: Full Study Report, version 1.8.2 (Akholi, forthcoming manuscript dated November 1, 2026), Part 5, “Manual Alteration by the Delivery Team” and “The Five Manual Alteration Methods,” fig. 5.1, https://doi.org/10.2139/ssrn.7164559.; Hatch, Agentic AI Outsourcing, Part 5, “Disclosure of Manual Alteration,” fig. 5.12 and table 5.8. ↩
2. Hatch, Agentic AI Outsourcing, Part 5, “Disclosure of AI-Output Manual Alteration to the Financial Institution,” account of a data-exception procedure agreed with the financial institution’s platform owner before correction. ↩
3. Elham Tabassi, Artificial Intelligence Risk Management Framework (AI RMF 1.0), NIST AI 100-1 (National Institute of Standards and Technology, January 2023), app. C, 40–41, https://doi.org/10.6028/NIST.AI.100-1.; Swiss Financial Market Supervisory Authority FINMA, Governance and Risk Management When Using Artificial Intelligence, FINMA Guidance 08/2024, December 18, 2024, sec. 2.4, 6, https://www.finma.ch/~/media/finma/dokumente/dokumentencenter/myfinma/4dokumentation/finma-aufsichtsmitteilungen/20241218-finma-aufsichtsmitteilung-08-2024.pdf?sc_lang=en. ↩
4. Hatch, Agentic AI Outsourcing, Part 5, “Manual Alteration by the Delivery Team” and “The Five Manual Alteration Methods,” fig. 5.1. ↩
5. Hatch, Agentic AI Outsourcing, Part 5, “Manual Alteration of Financial-Institution-Provided Data” and “Reasons for Manual Alteration of Financial-Institution-Provided Data.”. ↩
6. Vanessa Lyon et al., “Agentic AI Is Rewriting the Rules of Data Risk Management,” Boston Consulting Group, June 8, 2026, “Agentic AI Amplifies Existing Risks and Introduces New Data Risks Organizations Must Actively Manage” and “Technology and Architecture Enablers,” https://www.bcg.com/publications/2026/managing-data-risk-in-the-age-of-agentic-ai. ↩
7. Hatch, Agentic AI Outsourcing, Part 5, “Manual Alteration of Financial Institution Processes” and “Reasons for Manual Alteration of Financial Institution Processes.”. ↩
8. Hatch, Agentic AI Outsourcing, Part 5, “Manual Alteration of AI Outputs” and “Reasons for Manual Alteration of AI Outputs.”. ↩
9. Hatch, Agentic AI Outsourcing, Part 5, “Reporting Alteration,” table 5.2 and individual-contributor settlement-fails account. ↩
10. Hatch, Agentic AI Outsourcing, Part 5, “Third-Party Work Done by Hand” and “Reasons for Third-Party Work Done by Hand.”. ↩
11. Hatch, Agentic AI Outsourcing, Part 5, “Reasons Given for Manual Alteration,” table 5.7; “Reasons for Manual Alteration of AI Outputs,” accounts of pressure to continue and not raise output weakness with client. ↩
12. Hatch, Agentic AI Outsourcing, Part 5, “Recording of Manual Alteration,” table 5.9, “Systems of Record,” and parallel correction-sheet account. ↩
13. Financial Conduct Authority, “AI in Financial Services: Good Practice and Areas for Improvement,” published October 19, 2026, updated October 20, 2026, secs. 3.3–3.4, https://www.fca.org.uk/publications/good-poor-practice/ai-financial-services. ↩
14. Alessandro Ferrari, “Human Oversight in Automated Decision-Making: From Policy Language to Operational Control,” DLA Piper, July 9, 2026, “Procurement and Contract Implications,” https://www.dlapiper.com/en/insights/publications/law-in-tech/2026/human-oversight-in-automated-decision-making. ↩
15. Board of Governors of the Federal Reserve System, Federal Deposit Insurance Corporation, and Office of the Comptroller of the Currency, Interagency Guidance on Third-Party Relationships: Risk Management, June 7, 2023, 20–22, https://www.federalreserve.gov/supervisionreg/srletters/sr2304a1.pdf. ↩
16. Hatch, Agentic AI Outsourcing, Part 5, “Manual Alteration by the Delivery Team” and “Visibility in Reported Performance”; Introduction, “Evidentiary Basis and Its Limits.”. ↩

Bibliography

• Board of Governors of the Federal Reserve System, Federal Deposit Insurance Corporation, and Office of the Comptroller of the Currency. Interagency Guidance on Third-Party Relationships: Risk Management. June 7, 2023. https://www.federalreserve.gov/supervisionreg/srletters/sr2304a1.pdf.
• Ferrari, Alessandro. “Human Oversight in Automated Decision-Making: From Policy Language to Operational Control.” DLA Piper. July 9, 2026. https://www.dlapiper.com/en/insights/publications/law-in-tech/2026/human-oversight-in-automated-decision-making.
• Financial Conduct Authority. “AI in Financial Services: Good Practice and Areas for Improvement.” Published October 19, 2026. Updated October 20, 2026. Accessed October 23, 2026. https://www.fca.org.uk/publications/good-poor-practice/ai-financial-services.
• Hatch, Phil. Agentic AI Outsourcing at Tier 1 Financial Institutions: Full Study Report. Version 1.8.2. Akholi. Forthcoming manuscript dated November 1, 2026. Author-supplied manuscript consulted October 23, 2026. https://doi.org/10.2139/ssrn.7164559.
• Lyon, Vanessa, Nadya Bartol, Marianna Leoni, Hussein Abdulghani, Yassine Khendek, and Lucas Quarta. “Agentic AI Is Rewriting the Rules of Data Risk Management.” Boston Consulting Group. June 8, 2026. https://www.bcg.com/publications/2026/managing-data-risk-in-the-age-of-agentic-ai.
• Swiss Financial Market Supervisory Authority FINMA. Governance and Risk Management When Using Artificial Intelligence. FINMA Guidance 08/2024. December 18, 2024. https://www.finma.ch/~/media/finma/dokumente/dokumentencenter/myfinma/4dokumentation/finma-aufsichtsmitteilungen/20241218-finma-aufsichtsmitteilung-08-2024.pdf?sc_lang=en.
• Tabassi, Elham. Artificial Intelligence Risk Management Framework (AI RMF 1.0). NIST AI 100-1. National Institute of Standards and Technology, January 2023. https://doi.org/10.6028/NIST.AI.100-1.