Source: https://akholi.com/outsourcing-2026-agentic-ai-tier-1-banks/part-6-executive-action-plan/proposed-implementation-schedule/ Author: Phil Hatch Publisher: Akholi Proposed Implementation Schedule The 2026 Report · Part 6 # Proposed Implementation Schedule A staged audit and remediation program from Week 1 through the first year By Phil Hatch · Akholi · Version 1.8.2 Complete study · PDFPart 6 · PDFStudy overview / Part 6 / Proposed Implementation Schedule The proposed 52-week schedule moves from assessment, containment, and initial corrective action during the first 12 weeks to completion of the remaining first-year work. Containment limits exposure while an issue remains unresolved. The timetable is a planning assumption, not a study finding. Scope and dates should reflect engagement volume, severity, available resources, and applicable obligations. Table 6.2. Proposed implementation phases and oversight deliverables | Weeks | Actions | Oversight deliverables | | --- | --- | --- | | Week 1 | Appoint the audit lead and the executive accountable for corrections. Approve the mandate and budget. Preserve relevant records, establish risk-based interim controls and emergency procedures, and communicate the review’s purpose. | Mandate, appointments, preservation instructions, interim controls | | Week 2 | Assemble the audit team with defined roles and appropriate independence. Notify vendors of scope, access rights, and preservation expectations. Compile and reconcile the engagement inventory. | Review roles, engagement inventory | | Weeks 3 to 4 | Prioritize engagements and apply proportionate interim restrictions. Open the confidential channel. Issue the questionnaire, set initial response dates, and allow necessary follow-up. | Prioritized engagements, restrictions, participation status | | Weeks 5 to 8 | Review prioritized engagements on site or remotely as appropriate. Assess other engagements for emerging concerns. Document critical findings, evidence gaps, and the prioritized action plan. | Supported findings, action plan, decisions requested | | Weeks 9 to 12 | Implement prioritized corrections, verify closures, and decide controls for unresolved critical issues. Prepare the funded first-year plan and assign continuing oversight responsibilities. | Closure evidence, unresolved issues and controls, funded plan | | Weeks 13 to 52 | At week 13, approve priorities and decisions on reviewed engagements. Complete remaining reviews and corrective work, train relevant personnel, and independently verify material closures. Keep delays and unresolved findings visible. | Quarterly reports, year-end dispositions and unresolved findings | Note: Deliverables go to the oversight committee acting under the board’s delegation. Prioritized engagements are those selected for the initial detailed review. Critical findings are those whose financial exposure, operational impact, or control gaps require urgent containment or correction under documented prioritization criteria. Containment limits exposure while an issue remains unresolved. Closure requires evidence that corrective action works. Independent assurance is verification by personnel separate from those responsible for the correction. Disposition means a documented decision to continue, impose controls, restructure, transfer, or exit. The dates are proposed targets, and unresolved findings remain open and visible. ## 1 Week 1: Appoint the Audit Lead Week 1 should establish the review mandate and assign accountable leadership. The board or its designated oversight committee should appoint a senior executive as audit lead, with sufficient independence from engagement sponsorship and delivery. The oversight committee acts under the board’s delegation. The mandate should define scope, reporting, budget, access within applicable rights, escalation, and authority to recommend interim controls. Assign management responsibility for corrections separately from independent assurance of closure. Preserve relevant records, establish risk-based interim controls, and name the personnel authorized to suspend agent operation. Legal and compliance specialists should determine any notification, privacy, or privilege requirements. Management should explain the review’s purpose, cooperation expectations, and protections against retaliation for good-faith reporting. Emergency changes should remain possible through documented procedures. Agree reporting frequency with the oversight committee and escalate critical findings promptly. The first-week deliverables should be the approved mandate, named responsibilities, preservation instructions, and initial control decisions. > Reconciliation-break reports showed a shrinking break count each week, but the drop reflected a human logging in manually to clear breaks the agent could not touch, not the agent resolving more on its own. Settlement-funding reports never separated agent-initiated actions from human keyboard fixes, so the dashboard read as steady progress right up to cancellation.” INDIVIDUAL CONTRIBUTOR · BPO, Trade, settlement and reconciliation ## 2 Week 2: Form the Audit Team and Notify the Vendors Week 2 should establish an appropriately independent audit team and a reconciled engagement inventory. Assemble expertise in risk, compliance, legal matters, technology, procurement, outsourcing management, finance, and workforce issues as required. Preserve Internal Audit’s independence from management’s corrective responsibilities. If an external firm conducts interviews or supports the review, define its role and manage conflicts. It should not simultaneously act as an independent investigator and an advocate for a party under review. Notify vendors of the review’s scope, evidence requests, applicable access rights, and preservation expectations. Invite documented concerns about obstacles within the financial institution. Agree arrangements for participation by delivery team members and financial institution staff, confidentiality, and protection against retaliation, subject to applicable law and contractual provisions. Compile the engagement inventory from procurement, outsourcing, payment, technology, and model records. Include relevant pilots and transition work, record their subcontractors and third-party dependencies, and reconcile differences among the source registers. ## 3 Weeks 3 to 4: Rank Every Engagement and Open the Confidential Channel Weeks 3–4 should identify the prioritized engagements, those selected for the initial detailed review. Assess financial exposure, impact on the financial institution and its customers, regulatory relevance, agent autonomy, processing volume, and known control gaps. Use documented criteria to select the prioritized engagements and determine proportionate interim restrictions. Submit the prioritization method and material scope limitations to the oversight committee. Classify findings as critical when their financial exposure, operational impact, or control gaps require urgent containment or correction under the documented criteria. Record the reason for that designation. This review prioritization does not replace the study’s defined engagement-outcome categories. Open a protected channel for delivery team members and financial institution staff. Explain who can access identifiable information, how findings will be reported, the limits of confidentiality, and procedures for urgent concerns. State only those protections the review can provide. Report findings in aggregate where feasible without obscuring matters requiring action. Issue a questionnaire covering manual alteration, reasons, authorization, records, disclosure, reporting, and operational obstacles. Seek improvement proposals across financial institution readiness, vendor capability, co-management, AI technology, and the third-party ecosystem. Set initial response dates and allow meaningful participation and follow-up beyond week 4 where needed. Report participation and outstanding evidence requests to the oversight committee. > We did a POC with the bank to see if we could handle regulatory filings. Using the same sample documents, the AI never generated the same filing reports. The bank canceled the pilot and started looking at every other AI project.” ENGAGEMENT MANAGER · CXM, Client servicing and communications ## 4 Weeks 5 to 8: Audit the Prioritized Engagements Weeks 5–8 should produce an assessment of the prioritized engagements and an action plan supported by operational evidence. Conduct walkthroughs on site or remotely as appropriate. Examine four areas, retaining separate consideration of AI technology and the third-party ecosystem within the fourth. - Assess financial institution readiness through data and processes, organizational arrangements, dependent processes, assigned ownership, and the time taken to answer delivery requests and make decisions. - Assess vendor capability through the delivery team, documented delivery methods, controls over manual alteration, and knowledge of the financial institution’s business and applicable obligations. - Assess co-management through the two firms’ decision rights, change procedures, escalation routes, issue resolution, and the time taken to make decisions and resolve issues. - Assess AI technology through agent configurations, change history, and monitoring. Assess the third-party ecosystem separately through the services and dependencies on which those agents rely. Test controls in operation using risk-based samples. Reconstruct material manual alteration for the review period where evidence permits, reconcile performance reports to underlying work, and assess relevant skills. Record gaps in evidence explicitly. Reassess the remaining engagements as new concerns emerge and expand the prioritized reviews when warranted. Assign each critical finding an accountable owner, containment decision, corrective-action target, impact assessment, and evidence required for closure. Legal and compliance specialists should assess notification and contractual implications. By the end of week 8, the proposed deliverable is a supported assessment and prioritized action plan, with unresolved evidence gaps clearly identified. ## 5 Weeks 9 to 12: Correct the Critical Issues and Set the First-Year Plan Weeks 9–12 should deliver verified initial corrections, decisions on unresolved critical issues, and a funded first-year plan for approval. Management should implement prioritized corrections and verify them against operational evidence. Revised policies or attestations alone are insufficient to demonstrate that a correction works. Where critical risks remain, accountable executives should determine proportionate restrictions, suspension, or exit, with escalation through the financial institution’s risk governance arrangements. Containment measures should remain in place while the issue is unresolved. Prepare the first-year plan around four workstreams. - Review remaining engagements in risk order under a consistent evidence standard and document a disposition for each within an agreed timetable. - Strengthen co-management where required through assigned decision rights, shared issue records, defined response times, coordinated change control, manual alteration records, and reconciled reporting. - Address financial institution readiness through process and data ownership, validated inputs, appropriate access, documented dependencies, and training for engagement owners and oversight personnel. - Address vendor capability through relevant domain and regulatory training, demonstrated competence for assigned responsibilities, sustainable staffing, documented delivery methods, and clear requirements for manual alteration records and disclosure. Assign continuing responsibility for inventories, change control, monitoring, review capacity, suspension authority, and applicable requirements. Use existing governance functions where suitable and define additional responsibilities explicitly. Each action should have an owner, target date, budget, and criterion for closure supported by operational evidence. Require independent assurance proportionate to risk. Report unresolved critical issues and containment measures alongside the plan. ## 6 Weeks 13 to 52: Complete the First-Year Plan Week 13 should establish the approved priorities and decisions governing the remaining first-year work. The oversight committee should approve priorities and decide whether reviewed engagements continue, require additional controls or restructuring, or should transfer or exit, referring decisions to the board where required by its delegated authority. During the remainder of the year, monitor progress, verify material closures independently, and reassess residual risks. Submit quarterly progress reports. The year-end objective is a documented disposition for every in-scope engagement and evidence that required controls operate effectively. Keep delays and unresolved findings visible in those reports. The reported gaps in financial institution readiness, co-management, and visibility into manual alteration support a review grounded in the work actually performed. Financial institutions should use that evidence to decide which engagements can continue, which require correction or restriction, and which should transfer or exit. The proposed schedule provides a framework for those decisions. Its effectiveness must be judged by operational evidence of implemented controls and transparent reporting of unresolved findings. > we see it happen a lot on my team. i don't do the hands on fixes myself anymore, but i sign off on what they change, access provisioning never finish before we go live so the agents patch around missing permissions constantly, happens most days. and frankly i am tired of explaining it upward to management, though what actually reaches them versus what the team handles day to day, i sometimes wonder about that.” ENGAGEMENT MANAGER · CXM, Corporate and back-office functions ← Recommended Controls ## Links to related study evidence - [Part 6](https://akholi.com/outsourcing-2026-agentic-ai-tier-1-banks/part-6-executive-action-plan/) - [manual alteration](https://akholi.com/outsourcing-2026-agentic-ai-tier-1-banks/part-5-manual-alteration/) - [financial institution readiness](https://akholi.com/outsourcing-2026-agentic-ai-tier-1-banks/part-2-five-failure-categories/financial-institution-readiness/) - [vendor capability](https://akholi.com/outsourcing-2026-agentic-ai-tier-1-banks/part-2-five-failure-categories/vendor-capability/) - [co-management](https://akholi.com/outsourcing-2026-agentic-ai-tier-1-banks/part-2-five-failure-categories/co-management/) - [AI technology](https://akholi.com/outsourcing-2026-agentic-ai-tier-1-banks/part-2-five-failure-categories/ai-technology/) - [third-party ecosystem](https://akholi.com/outsourcing-2026-agentic-ai-tier-1-banks/part-2-five-failure-categories/third-party-ecosystem/)