Reported Governance Weaknesses Across All 150 Engagements

Reported control weaknesses were widespread, but their depth varied. Ratings of 3 or below occurred on 145 of the 150 engagements, while written accounts classified as governance weaknesses occurred on all 150. Only 50 engagements had a mean governance, oversight, and control score of 3 or below. These are different findings: the presence of one reported weakness is not equivalent to a low composite mean or independently established overall governance failure. The canceled-versus-active contrast was substantial, whereas structural group comparisons were less conclusive.

The governance, oversight, and control score is the mean of the 47 governance-related indicator ratings available for each respondent. Respondent means are averaged within engagements, and engagement means are then averaged across the study. Low-rating counts report ratings of 3 or below separately from the score. Written instances count answers classified negative on a governance indicator or describing one of the 26 forms in Table 3.1. These measures describe different aspects of reported control weakness. Numeric score bands are descriptive and do not represent validated stages of control development.

The measures were strongly related across the 150 engagements. Correlation, denoted r, expresses the direction and strength of a linear association on a scale from −1 to +1. The score correlated at −0.97 with low ratings per respondent and at −0.78 with written instances per respondent. These are complementary descriptions from shared respondents and source material, rather than independent validation. The five engagements with no low governance rating were active and in the highest indicator quintile, the highest fifth ranked by the mean of all 100 engagement indicators. Their scores ranged from 6.62 to 7.38, yet each had 5–15 written instances of weakness. The median engagement had 21.50 such instances, within a range of 5–44.

Respondent role, engagement status, expected cancellation, and the four study measures showed relationships with the reported control environment. The structural group comparisons did not detect adjusted differences on the stated measures. Team size and age use continuous analysis and an equivalence margin, the largest association treated as sufficiently small under the study's criterion. Table 3.2 summarizes those results. Nonsignificance does not establish identical governance, and equivalence concerns only the specified range of associations.

Data governance gaps in the source feeds were logged by the vendor as agent exceptions rather than data issues, which made the bot look like the problem when the feed was the actual cause.”

INDIVIDUAL CONTRIBUTOR · BPO, Trade, settlement and reconciliation

1 The Governance, Oversight, and Control Score

The score and low-rating counts identify different levels of weakness. Mean scores were 3 or below for 283 of 850 respondents and 50 of 150 engagements, while at least one low governance rating was recorded by 743 respondents. The composite includes controls from all five failure categories, with unequal category representation. That composition must be considered when an individual item is compared with the wider control environment.

1.1 Composition of the Governance, Oversight, and Control Score

Definition · The governance, oversight, and control score · Analyzed only in Part 3

The governance, oversight, and control score places joint control between the financial institution and vendor at the center of its measurement. Co-management supplies 20 of the 47 indicators, compared with seven for financial institution readiness, two for vendor capability, eight for AI technology, and ten for the third-party ecosystem. This composition makes cross-category comparison necessary when asking whether an individual control is associated with governance elsewhere. It also means that the composite is not an equal-weight comparison of the five categories.

The 47 indicators divide by failure category into co-management with 20, the third-party ecosystem with 10, AI technology with 8, financial institution readiness with 7, and vendor capability with 2. Co-management carries 42.55% of the measure. The 19 governance indicators listed in Appendix C are a subset of the 47.

Each rating entered the measure on its favorable end. The ratings were averaged for each respondent, the respondent values were averaged within each engagement, and the engagement values were averaged across the 150 engagements. Where the indicator under test was one of the 47, it was removed from the score before the comparison, so no indicator was tested against a measure that contained it.

Excluding an item from the score removes its direct contribution but leaves other related items, including 19 co-management items when a co-management indicator is tested. The cross-category comparison instead removes that entire category. Adjustment then accounts for one variable, the mean of the 53 indicators outside the score. These specifications ask different conditional questions. Neither isolates an independently established causal effect.

1.2 The Score Across Respondents and Engagements

Definition · The governance, oversight, and control score across respondents and engagements · Analyzed only in Part 3

Low ratings were more widespread than low composite means. A respondent could report a serious weakness in one control while giving other controls higher ratings, so the mean alone does not describe the reach of reported deficiencies. The distinction matters for oversight: isolated weaknesses and a broadly low assessment of controls are different findings. Both remain visible through separate reporting of low individual ratings, respondent means, and engagement means.

Of the 37,472 ratings given to the 47 indicators, 16,074 (42.90%) were distressed, and they came from 743 respondents on 145 engagements. The score stood at 3.99 across respondents (n = 850) and at 4.01 across engagements (n = 150). Its distressed range held 283 respondents (33.29%) and 50 engagements (33.33%).

Favorable indicator ratings usually coincided with composite scores above 3. Among respondents rating a governance indicator at 8–10, none had a score of 3 or below after that item was omitted, with one exception among the 60 rating tool-report accuracy at 8–10. Composite scores were at 3 or below for 35.83% of individual contributors, 28.00% of engagement managers, and 6.45% of portfolio directors. The mean score was 2.58 on canceled engagements, compared with 4.69–4.94 across the active stages.

Written instances reached further than either measure. They numbered 3,330 of the 6,862 written answers that addressed the respondent's own engagement (48.53%), from 838 of the 850 respondents on all 150 engagements. The five engagements without a distressed governance rating carried between 5 and 15 written instances each. On one of them, an individual contributor reported correcting almost every batch without raising a ticket, the correction accepted by the team as part of the job. On another, an individual contributor reported that the ownership of a case taken over midway by an agent had never been written down.

“This happens on almost every batch, because of that i do not raise ticket for each one, only when it affects release, for that reason most of correcting stays with me and team just accepts it as part of job” -Individual Contributor, ITO, Technology engineering and operations

“Happy enough with this one in truth. But one thing is missing here… when merchant raises chargeback dispute and agent picks it up halfway, nobody has written down who owns case after that point. My team decides between ourselves, usually works out. And nobody has ever asked us how we decide it” -Individual Contributor, CXM, Payments, cards and disputes

2 Governance Indicators Across the Five Failure Categories

The five categories showed related governance concerns at different levels of low-rating prevalence. Readiness, co-management, and vendor capability had larger low-rating shares than the technology and third-party categories. This comparison concerns pooled ratings rather than unique respondents. The cross-category analysis asks a further question: whether an individual control is associated with the wider score after accounting for the other-indicator mean. Its interpretation depends on category composition and test-family choice.

Low indicator ratings and a low composite mean are different quantities. Among respondents rating a technology control at 1–3, 74.90%–78.54% had a score of 3 or below after the tested indicator was omitted. The corresponding range was 73.41%–80.41% for third-party controls, 61.19%–65.21% for co-management, and 54.26%–57.31% for readiness. These conditional shares are not the prevalence of low indicator ratings. Table 3.4 reports the separate cross-category associations under the specified model.

2.1 Financial Institution Readiness

Failure category · 7 governance indicators · Full analysis of each indicator in Part 2, Financial Institution Readiness

Financial institution readiness had the largest share of low governance-related ratings. This places the institution's own data, access, management, and control responsibilities within the governance problem rather than treating governance as a vendor-only obligation. The adjusted comparisons provide more qualified evidence about relationships with the other categories. They cannot establish that the institution's individual controls matter only through its overall readiness.

The seven readiness indicators were distressed in 2,858 of 5,597 ratings (51.06%), the highest share of the five categories, and their means ran from 3.47 to 3.61. The category mean was distressed on 60 of the 150 engagements (40.00%).

Each readiness indicator was associated with governance in the other four categories at r = 0.72 to 0.76 (n = 150 engagements). After adjustment for the mean of the other 53 indicators, the partial r ran from −0.18 to 0.22, and two of the seven associations were significant. The governance of the financial institution's data carried the one positive tie (partial r = 0.22). The speed of the financial institution's response to issues raised carried a small inverse result (partial r = −0.18) that reversed to 0.13 once the institution's other readiness indicators were omitted from the comparison mean.

The association of each indicator with the score computed without it, measured across respondents, held within the canceled engagements at r = 0.54 to 0.62, the lowest of the five categories. It held within each active stage, at 0.58 to 0.69 in Build-Out, 0.71 to 0.79 in Transition/Cut-Over, and 0.64 to 0.76 in Production. Within role, it ran from 0.74 to 0.78 among individual contributors and from 0.51 to 0.75 among the 31 portfolio directors.

Among respondents who rated a readiness indicator 1 to 3, 54.26% to 57.31% had a score of 3 or below, the lowest range of the five categories. Across the seven indicators, ratings of 8 to 10 numbered 126, and none came from a respondent with a score of 3 or below. The 1,479 written answers on the readiness indicators held 1,323 negative answers, and 381 of the negative answers described one of the 26 forms of a control bypassed or not working.

Part 2 (Financial Institution Readiness) analyzes each indicator in full, and Financial Institution Readiness and the Governance of Agentic Work reads each against reported governance weakness.

2.2 Co-Management

Failure category · 20 governance indicators · Full analysis of each indicator in Part 2, Co-Management

Co-management showed consistently positive associations with governance in the other four categories, including after the specified composite adjustment. The substantive concern is coordination across firms: decision rights, change control, review, and incident management must operate across the same work. The consistency of the 20 estimates supports examining that shared operating arrangement. Its apparent statistical distinctiveness remains conditional on score composition, comparison-measure composition, and the stated family of tests.

Each of its 20 indicators was associated with governance in the other four categories at r = 0.75 to 0.80 (n = 150 engagements). After that adjustment, the partial r ran from 0.21 to 0.31, and all 20 associations were significant. No indicator outside co-management carried a significant positive adjusted association except the governance of the financial institution's data.

The 20 indicators were distressed in 7,866 of 15,968 ratings (49.26%), the second-highest share of the five categories, and their means ran from 3.60 to 3.73. The category mean was distressed on 63 of the 150 engagements (42.00%), more than in any other category.

The association of each indicator with the score computed without it held within the canceled engagements at r = 0.74 to 0.82, the highest of the five categories. Within the active stages it ran from 0.75 to 0.83 in Build-Out, 0.80 to 0.86 in Transition/Cut-Over, and 0.82 to 0.89 in Production. Within role, it ran from 0.86 to 0.88 among individual contributors and from 0.76 to 0.90 among portfolio directors.

Among respondents who rated a co-management indicator 1 to 3, 61.19% to 65.21% had a score of 3 or below. Across the 20 indicators, ratings of 8 to 10 numbered 605, and none came from a respondent with a score of 3 or below. The 1,146 written answers on the co-management indicators held 903 negative answers, and 199 of the negative answers described one of the 26 forms of a control bypassed or not working.

Part 2 (Co-Management) analyzes each indicator in full, and Co-Management and Governance Across the Other Four Categories reads each against reported governance weakness.

2.3 Vendor Capability

Failure category · 2 governance indicators · Full analysis of each indicator in Part 2, Vendor Capability

The vendor's playbook and readiness to accept accountability were associated with the wider control environment, but their adjusted coefficients changed sharply with the comparison measure. For governance, these indicators concern whether the vendor has a defined route into controlled production and accepts responsibility when agent work causes loss. The results support examining those responsibilities. They do not show that weak vendor controls improve governance or that their relationship is exhausted by general capability.

The two indicators were distressed in 765 of 1,601 ratings (47.78%), and their means were 3.65 and 3.67. The category mean was distressed on 58 of the 150 engagements (38.67%).

The two vendor indicators correlated with governance in the other four categories at approximately r = 0.78. Their adjusted partial correlations were −0.38 for the playbook and −0.46 for accountability, both nominally significant. The comparison mean contains the vendor's 18 other capability indicators. Removing those items changed the estimates to 0.04 and −0.03. This sensitivity demonstrates dependence on the adjustment measure and limits an interpretation of the negative coefficients as distinct effects of these controls.

The association of each indicator with the score computed without it held within the canceled engagements at r = 0.66 to 0.69. Within the active stages it ran from 0.70 to 0.71 in Build-Out, 0.65 to 0.66 in Transition/Cut-Over, and 0.77 to 0.81 in Production. Within role, it ran from 0.78 to 0.79 among individual contributors and stood at 0.68 for each indicator among portfolio directors.

Among respondents who rated a vendor capability indicator 1 to 3, 59.18% and 64.34% had a score of 3 or below. Ratings of 8 to 10 numbered 44 across the two indicators, and none came from a respondent with a score of 3 or below. The 238 written answers on the two indicators held 215 negative answers, and 25 of the negative answers described one of the 26 forms of a control bypassed or not working.

Part 2 (Vendor Capability) analyzes each indicator in full, and Vendor Preparation and Accountability in the Control Environment reads both against reported governance weakness.

2.4 AI Technology

Failure category · 8 governance indicators · Full analysis of each indicator in Part 2, AI Technology

Low technology-control ratings were associated with low composite scores, connecting the operation of technical safeguards to the broader control environment. The eight indicators concern whether agent actions remain authorized, observable, testable, and subject to effective safeguards. The main adjusted model did not detect positive cross-category associations for these controls. That conditional result limits a claim of statistical independence, while leaving their substantive control functions and strong observed associations intact.

The eight technology indicators were distressed in 2,052 of 6,362 ratings (32.25%), and their means ran from 4.54 to 4.66. The category mean was distressed on 30 of the 150 engagements (20.00%).

Among respondents who rated a technology control 1 to 3, 74.90% to 78.54% had a score of 3 or below. Across the eight indicators, ratings of 8 to 10 numbered 551, and one came from a respondent with a score of 3 or below.

The technology indicators correlated with the other four categories at r = 0.77–0.81. In the main adjusted model, partial r ranged from −0.09 to 0.08 and none met nominal p < 0.05. This is a conditional result. For authorized action, removing the other 12 AI technology items from the comparison mean changed partial r from −0.03 (p = 0.745) to 0.29 (p < 0.001). The sensitivity qualifies any conclusion that technology controls have no relationship of their own.

Associations between each technology indicator and the score excluding it ranged from 0.65 to 0.70 in Build-Out, 0.71 to 0.77 in Transition/Cut-Over, and 0.78 to 0.82 in Production. Within canceled engagements they ranged from 0.66 to 0.72. The stage ordering is descriptive and is not a test that associations strengthened over time. Within role, correlations ranged from 0.79 to 0.82 among individual contributors and from 0.61 to 0.87 among portfolio directors.

The 493 written answers on the technology indicators held 402 negative answers, and 42 of the negative answers described one of the 26 forms of a control bypassed or not working.

Part 2 (AI Technology) analyzes each indicator in full, and Technical Controls and Governance Across the Engagement reads each against reported governance weakness.

2.5 Third-Party Ecosystem

Failure category · 10 governance indicators · Full analysis of each indicator in Part 2, Third-Party Ecosystem

Third-party control ratings connected external dependencies with the broader governance environment. Advance notice, monitoring, contractual coverage, and dependency management concern work that the financial institution and vendor cannot govern through internal procedures alone. Low ratings in this category commonly accompanied low composite scores. The adjusted results did not establish a separate positive relationship under the specified model, and they do not demonstrate that external controls have no distinct operational importance.

The ten third-party indicators were distressed in 2,533 of 7,944 ratings (31.89%), the lowest share of the five categories, and their means ran from 4.58 to 4.66. The category mean was distressed on 34 of the 150 engagements (22.67%).

Among respondents who rated a third-party control 1 to 3, 73.41% to 80.41% had a score of 3 or below, and the upper end of the range was the highest share of the 47 governance indicators. Across the ten indicators, ratings of 8 to 10 numbered 764, and none came from a respondent with a score of 3 or below.

Each third-party indicator was associated with governance in the other four categories at r = 0.75 to 0.78 (n = 150 engagements). After adjustment for the mean of the other 53 indicators, the partial r ran from −0.14 to −0.04, and none of the ten was significant.

Within canceled engagements, third-party indicator associations with the score excluding the item ranged from 0.65 to 0.73. Across active stages, the ranges were 0.70–0.79 in Build-Out, 0.69–0.77 in Transition/Cut-Over, and 0.72–0.81 in Production. These comparisons do not establish a change over time. Within role, correlations ranged from 0.79 to 0.82 among individual contributors and from 0.70 to 0.84 among portfolio directors.

The 522 written answers on the third-party indicators held 372 negative answers, and 233 of the negative answers described one of the 26 forms of a control bypassed or not working, the highest proportion of the five categories.

Part 2 (Third-Party Ecosystem) analyzes each indicator in full, and Third-Party Dependencies and the Limits of Internal Control reads each against reported governance weakness.

3 Governance Across the Segments of the Study

Structural classifications did not clearly distinguish governance depth after the stated adjustment, whereas respondent role did. Reported weaknesses extended across financial institution types, outsourcing models, process families, vendor types, locations, and classes of work. This pattern gives limited support to a simple structural explanation of the score variation. It also directs attention to the operation of controls within engagements, without establishing equality between the structural groups.

3.1 Financial Institution Type

Segment · 10 financial institution types · Full analysis in Part 1, Structural Attributes and Outcome Associations, section 1.1

Reported governance weaknesses extended across the financial institution types examined. The adjusted comparisons did not detect differences in the three measures of depth, while lower scores on canceled engagements appeared within the larger type groups. The evidence gives limited support for attributing the governance pattern to financial institution type. It does not establish that the types have identical control arrangements or identical levels of risk.

Across the nine types with 10 or more engagements, the score ranged from 3.34 in investment banking (n = 19 engagements) to 4.40 in retail and consumer banking (n = 12), with Holm p = 1.00. Distressed governance ratings per respondent ranged from 15.50 to 23.94, and written instances per respondent from 3.42 to 4.41, each with Holm p = 1.00.

The five failure categories showed no clearly detected adjusted differences. Co-management ran from 2.83 in investment banking to 4.15 in payments and merchant acquiring, and the third-party ecosystem from 3.64 in investment banking to 5.39 in retail and consumer banking. Each of the five category means carried Holm p = 1.00, including financial institution readiness at 3.14 to 4.00.

Within each type, the score was associated with cancellation, from r = −0.56 in payments and merchant acquiring (n = 13 engagements) to r = −0.85 in retail and consumer banking (n = 12). Private equity and private capital, with 9 engagements and a score of 4.08, is reported as a count only.

3.2 Outsourcing Model

Segment · 4 outsourcing models · Full analysis in Part 1, Structural Attributes and Outcome Associations, section 3.1

The governance pattern extended across all four outsourcing models. Each included lower-scoring canceled engagements and reported weaknesses across the five categories, without a detected adjusted difference between models. For the paper's central question, the model label alone does not account for the observed variation in control assessments. Differences in operating arrangements within a model remain possible and should not be dismissed by a nonsignificant group comparison.

The score stood at 4.28 under CXM (n = 42 engagements), 4.07 under ITO (n = 40), 3.98 under KPO (n = 31), and 3.64 under BPO (n = 37), with Holm p = 1.00. Distressed governance ratings per respondent ran from 16.81 under CXM to 21.87 under BPO, and written instances per respondent from 3.74 under KPO to 4.05 under BPO, each with Holm p = 1.00.

BPO engagements stood lowest in all five failure categories without differing from the other models in any of them. Co-management ran from 3.21 under BPO to 4.02 under CXM, and AI technology from 4.20 under BPO to 4.77 under ITO, each with Holm p = 1.00.

Within each model, the score was associated with cancellation at r = −0.72 under CXM and ITO, −0.71 under KPO, and −0.78 under BPO, on 12 to 15 canceled engagements per model.

3.3 Process Family

Segment · 8 process families · Full analysis in Part 1, Structural Attributes and Outcome Associations, section 3.3

The process-family comparisons did not identify a clear adjusted difference in governance depth. This broadens the reported control concern beyond a single type of financial institution work. It also limits the explanation that the paper's overall pattern arises principally from the mix of processes sampled. The comparisons describe the families with sufficient engagement bases, with smaller groups retained descriptively.

Across the five families with 10 or more engagements, the score ranged from 3.39 in trade, settlement and reconciliation (n = 15 engagements) to 4.41 in payments, cards and disputes (n = 12), with Holm p = 0.874. Distressed governance ratings per respondent ranged from 14.37 to 24.93 (Holm p = 0.484), and written instances per respondent from 3.46 to 4.19 (Holm p = 1.00).

Co-management came closest to a difference among the eight measures. It stood at 2.76 in trade, settlement and reconciliation against 4.20 in payments, cards and disputes, a difference that reached p = 0.019 before adjustment and did not survive it (Holm p = 0.148). The share of respondents with a score of 3 or below also differed by family before adjustment (Monte Carlo p = 0.026), while the means did not.

Within each family, the score was associated with cancellation, from r = −0.63 in payments, cards and disputes to r = −0.77 in client servicing and communications. Credit, underwriting and suitability (9 engagements, the score 4.75), regulatory, audit, tax and legal (9, 3.70), and financial crime and client onboarding (7, 3.29) fall below the threshold of 10 engagements and are reported as counts in Table 3.6.

3.4 Vendor Type

Segment · 5 vendor types · Full analysis in Part 1, Structural Attributes and Outcome Associations, section 5.1

Vendor type did not clearly distinguish engagement-level governance assessments after adjustment. The nominal respondent-level difference also did not survive the reported multiplicity correction. Governance weaknesses appeared across the vendor types represented, rather than being confined to one provider model. These comparisons concern vendor classifications, not an independently measured test of each vendor's control effectiveness.

The score ranged from 3.68 for BPO specialists (n = 37 engagements) to 4.28 for consulting firms (n = 23), with Holm p = 1.00. At the respondent level the difference reached p = 0.017 before adjustment and did not survive it (Holm p = 0.136).

Vendor capability, the category that measures the vendor itself, ran from 3.47 for BPO specialists to 4.07 for pure-play agentic AI firms, with Holm p = 1.00. BPO specialists stood lowest in all five categories, and none of the five differences survived adjustment. Distressed governance ratings per respondent ranged from 17.49 to 22.03, and written instances per respondent from 3.74 to 4.17, each with Holm p = 1.00.

Within each vendor type, the score was associated with cancellation, from r = −0.68 for BPO specialists and pure-play agentic AI firms to r = −0.83 for boutique or specialist providers. The pure-play agentic AI firms carried the fewest canceled engagements, 5 of 14.

3.5 Delivery Location

Segment · 3 delivery locations · Full analysis in Part 1, Structural Attributes and Outcome Associations, section 3.4

Delivery location did not clearly distinguish the reported governance measures after adjustment. Lower scores on canceled engagements appeared within India, the United States, and the combined group of other locations. The finding directs attention to control arrangements within engagements rather than a simple geographic explanation. The combined other-location group should be understood as the reported aggregate, with no inference that every location within it is equivalent.

Engagements delivered from India recorded a score of 4.03 (n = 92 engagements), those delivered from the United States 3.79 (n = 19), and those delivered from all other locations 4.07 (n = 39), with Holm p = 1.00. Distressed governance ratings per respondent stood at 18.77, 19.71, and 18.67, and written instances per respondent at 3.90, 3.98, and 3.91, each with Holm p = 1.00.

The category means varied within narrow ranges. Co-management ran only from 3.58 to 3.69 across the three locations, and the widest range, in the third-party ecosystem, ran from 4.20 in the United States to 4.93 elsewhere, with Holm p = 1.00 for every category.

Within each location, the score was associated with cancellation at r = −0.70 in India, −0.78 in the United States, and −0.74 elsewhere.

3.6 Class of Work

Segment · 2 classes of work · Full analysis in Part 1, Structural Attributes and Outcome Associations, section 3.2

The two classes of work showed no clearly detected adjusted difference in governance depth. Reported control weaknesses thus extended to both line-of-business operations and corporate functions. This comparison concerns the broad class of work, while the governance analysis continues to examine the specific responsibilities, evidence, and review arrangements within each engagement.

LOB Operational engagements recorded a score of 3.93 (n = 76 engagements) and Corporate Functional engagements 4.08 (n = 74), with Holm p = 1.00. Distressed governance ratings per respondent stood at 19.79 and 17.91, and written instances per respondent at 3.85 and 3.97, each with Holm p = 1.00.

The two classes differed by less than half a point in every failure category. The widest gap lay in AI technology, at 4.42 for LOB Operational against 4.77 for Corporate Functional engagements, and financial institution readiness stood at 3.55 and 3.57, each with Holm p = 1.00.

Within each class, the score was associated with cancellation at r = −0.69 on LOB Operational engagements, 30 of them canceled, and at r = −0.75 on Corporate Functional engagements, 26 of them canceled.

3.7 Delivery Team Size

Segment · Delivery team size, current headcount · Full analysis in Part 1, Structural Attributes and Outcome Associations, section 6.1

Delivery team headcount had a small negative observed association with the score, and the conventional correlation test did not detect a clear relationship. The finding provides little support for a simple explanation in which larger teams systematically govern better or worse. Equivalence is a separate question: the study's test uses a correlation margin of ±0.30. The bounded conclusion applies to that margin and this sample.

The team-size correlation with the score was r = −0.11 (95% CI −0.26 to 0.06, p = 0.199, n = 150 engagements). The equivalence p value was 0.007 under the study's ±0.30 margin. This bounds the association under that criterion rather than demonstrating identical governance at every team size. Correlations with low-rating counts and written instances per respondent were 0.09 (p = 0.250) and 0.06 (p = 0.461).

3.8 Respondent Role

Segment · 3 respondent roles · Full analysis in Part 4, Composition and Experience of the Delivery Workforce, section 1

Governance assessments differed by respondent role, with individual contributors reporting lower scores than engagement managers and portfolio directors. The difference matters because the staff performing agent-related work may see control limitations that higher-level assessments capture less strongly. That explanation remains interpretive. The study compares reported perspectives and does not independently verify which role provides the most accurate assessment.

Individual contributors recorded a score of 3.86 (n = 667 respondents), with 35.83% in the distressed range. Engagement managers recorded 4.29 (n = 150), with 28.00% distressed, and portfolio directors 5.19 (n = 31), with 6.45% distressed (Holm p < 0.001). The size of the difference was small, with ω² of 0.025.

Distressed governance ratings followed the same order, at 19.73 per individual contributor, 17.56 per engagement manager, and 9.03 per portfolio director (Holm p < 0.001). Written instances numbered 4.09, 3.33, and 3.26 per respondent (Holm p < 0.001). Every failure category stood lowest among individual contributors and highest among portfolio directors, with co-management at 3.52 against 4.98 and financial institution readiness at 3.41 against 4.66, and the differences held after Holm adjustment for all eight measures (Holm p of 0.002 or less).

The roles differed in the depth of failure they reported, while every governance indicator associated with the score within every role. Each of the 47 governance indicators was associated with the score computed without it within each role, at r = 0.74 to 0.88 among individual contributors, 0.71 to 0.89 among engagement managers, and 0.51 to 0.90 among portfolio directors. The lowest value, 0.51, belonged to the governance of the financial institution's data among the 31 portfolio directors.

The role gradient reached manual alteration. Individual contributors were 418 of the 421 respondents who altered financial-institution-provided data, 481 of the 490 who altered processes, and 276 of the 278 who altered AI outputs, while reporting alteration reached 86 of the 150 engagement managers. Within each role, the score was associated with cancellation at r = −0.64 among individual contributors, −0.63 among engagement managers, and −0.57 among portfolio directors. The two customer management executives are reported as a count only. One individual contributor on a reconciliation engagement reported that the breaks the contributor cleared went unreviewed above the role.

“these ask about the two firms together, on my side it is only me and the custodian file. thus i mark low, nobody above me looks at the breaks i clear” -Individual Contributor, BPO, Trade, settlement and reconciliation

4 Governance by Lifecycle Stage, Engagement Age, and Expected Cancellation

Lower scores were associated with canceled engagements and with greater expected cancellation among active engagements. The three active lifecycle stages showed relatively similar mean scores, and engagement age did not show a clear conventional linear association. Together, these comparisons distinguish engagement state from elapsed time. They do not establish a trajectory in which the same engagement's governance improves or deteriorates as it moves between stages.

4.1 Lifecycle Stage

Segment · 3 active lifecycle stages and canceled engagements · Full analysis in Part 1, The Immaturity of Agentic AI Outsourcing, section 1.1

Active engagements at all three lifecycle stages had higher mean scores than canceled engagements. The active-stage means were relatively close, while low ratings remained present in Build-Out, Transition/Cut-Over, and Production. This indicates that reported control weaknesses were not confined to early implementation. The comparison is cross-sectional and does not show that a given engagement improved, deteriorated, or changed when it was canceled.

The score stood at 4.85 in Build-Out (n = 31 engagements), 4.94 in Transition/Cut-Over (n = 43), and 4.69 in Production (n = 20), against 2.58 on the 56 canceled engagements. Distressed governance ratings rose slightly across the active stages, from 57.39 per engagement in Build-Out to 62.37 in Transition/Cut-Over and 65.95 in Production, and stood at 183.82 per canceled engagement.

Per respondent, distressed governance ratings numbered 10.37, 10.67, and 12.47 across the active stages and 32.14 on canceled engagements. Written instances numbered 3.29, 3.35, and 3.33 per respondent across the active stages, and 4.90 on canceled engagements. The differences across the four levels held after Holm adjustment for all eight measures (Holm p < 0.001), while the three active stages stood within 0.25 of one another on the score.

Every failure category stood lowest on the canceled engagements. Co-management fell to 2.19 there against 4.05 to 4.66 in the active stages, and the third-party ecosystem to 3.07 against 5.42 to 5.66. The association of the technology controls to the score varied across the active stages, a pattern set out under AI Technology. An engagement manager on a production engagement reported that neither firm could say who owned a model that gave two figures on two runs, while stopping it quickly worked.

“Last month attrition model re-runs twice and gives two different figures. And nobody on either side can say who owns that. We can stop it quickly, that part works.” -Engagement Manager, KPO, Corporate and back-office functions

4.2 Engagement Age

Segment · Engagement age in months · Full analysis in Part 1, The Immaturity of Agentic AI Outsourcing, section 1.2

Engagement age had a small observed association with the score and no clearly detected linear relationship in the conventional correlation test. The age comparison offers limited evidence that time in operation alone distinguishes the reported control environment. The recorded equivalence result concerns the specified correlation margin. Neither result measures how the same engagement's governance developed over time.

Engagement age correlated with the score at r = 0.07 (95% CI −0.09 to 0.23, p = 0.373, n = 150 engagements). The equivalence p value under the recorded ±0.30 margin is 0.002. Correlations with low ratings and written instances per respondent were −0.06 (p = 0.450) and −0.14 (p = 0.085). The findings concern differences among engagements of different ages. They do not show whether governance matured or deteriorated within an engagement.

4.3 Expected Cancellation

Segment · 3 bands of cancellation likelihood and canceled engagements · Full analysis in Part 1, Cancellation and the Risk of Cancellation, section 2.1

Among active engagements, higher expected cancellation was associated with lower mean scores. The pattern connects perceived engagement instability with reported governance weakness before observed cancellation is used as a separate comparison. Expected cancellation is a delivery-team assessment, so its association may reflect shared perceptions of the engagement. It is not a validated forecast or evidence that the controls caused the anticipated outcome.

The score stood at 5.61 on the 36 active engagements below moderate risk, 4.63 on the 39 at moderate risk, and 3.91 on the 19 at high risk, against 2.58 on the 56 canceled engagements (Holm p < 0.001).

Distressed governance ratings numbered 5.67 per respondent below moderate risk, 12.19 at moderate risk, and 18.42 at high risk, or 32.69, 70.69, and 97.16 per engagement. Written instances numbered 2.99, 3.34, and 3.92 per respondent, or 16.89, 19.21, and 21.05 per engagement. Each measure differed across the bands after Holm adjustment (Holm p < 0.001).

The gradient ran through all five failure categories. From the high-risk band to the band below moderate risk, co-management rose from 3.59 to 5.32, financial institution readiness from 3.24 to 4.92, vendor capability from 3.48 to 5.01, AI technology from 4.71 to 6.07, and the third-party ecosystem from 4.48 to 6.38, each with Holm p < 0.001. The high-risk engagements had not been canceled, yet their governance stood closer to the canceled engagements than to the active engagements below moderate risk.

5 Governance Against the Four Study Measures

The score was strongly related to several broader assessments of the engagement. Canceled engagements and respondents intending to leave had lower scores, while customer satisfaction and the mean of the other indicators were positively associated with it. These relationships connect the reported control environment with performance and workforce experience. Their common source, retrospective design, and model dependence limit claims about an independent causal contribution.

5.1 Cancellation

Study measure · Cancellation · Full analysis in Part 1, Cancellation and the Risk of Cancellation, section 1.1

Already canceled engagements had substantially lower mean scores than active engagements, and a negative association remained after adjustment for the other-indicator mean. This makes cancellation an important descriptive contrast for understanding the reported control environment. It does not establish whether governance weaknesses preceded cancellation, followed it, or were assessed differently after it. The discrimination result describes separation within this sample.

The 56 canceled engagements recorded a score of 2.58, against 4.86 on the 94 active engagements (Welch p < 0.001), and the score separated the two with an area under the curve of 0.95. It was associated with cancellation at r = −0.72 (95% CI −0.79 to −0.63, n = 150 engagements). After adjustment for the comparison mean, the association remained at partial r = −0.25 (p = 0.002).

The two counts kept larger ties than the score. Distressed governance ratings numbered 32.14 per respondent on canceled engagements against 10.95 on active ones, an association with cancellation of r = 0.76 that remained at partial r = 0.43 after that adjustment (p < 0.001). Written instances numbered 4.90 per respondent against 3.33, an association of r = 0.64 that remained at partial r = 0.22 (p = 0.007).

Every failure category carried the gap. On canceled engagements co-management stood at 2.19 against 4.05 to 4.66 across the active stages, financial institution readiness at 2.38 against 4.19 to 4.36, vendor capability at 2.44 against 4.25 to 4.76, AI technology at 3.14 against 5.37 to 5.54, and the third-party ecosystem at 3.07 against 5.42 to 5.66. Within each role, the score was associated with cancellation at r = −0.64 among individual contributors, −0.63 among engagement managers, and −0.57 among portfolio directors.

The 56 canceled engagements had been canceled when their delivery teams answered, so the contrast is descriptive. On one canceled engagement, an audit-readiness report marked a reporting rule as documented whenever any version of the rule existed, and the gap surfaced only when the auditor asked.

“The vendor's audit-readiness dashboard marked a reporting rule as fully documented once any version of the rule existed in the knowledge base, without checking whether that version matched the rule the agent was actually executing, so undocumented rule changes never surfaced as a gap until the auditor asked directly.” -Individual Contributor, KPO, Regulatory, audit, tax and legal

5.2 Customer Satisfaction

Study measure · Customer satisfaction · Full analysis in Part 1, Customer Satisfaction, Delivery Performance, and Measured Return, section 1.1

Higher scores were strongly associated with higher customer satisfaction among active engagements. Much of that association was shared with the engagement's standing on the other indicators, and the adjusted estimate was smaller and did not meet the nominal significance threshold. The finding connects reported control quality with the institution's assessment of delivery while limiting a claim that governance contributes a statistically distinct relationship under this model.

Among the 94 active engagements, the score correlated with customer satisfaction at r = 0.80 (95% CI 0.71–0.86). After adjustment for the mean of the other 53 indicators, partial r was 0.19 (p = 0.069). The smaller estimate did not meet the nominal threshold, with no inference that the true adjusted association is zero.

Low-rating counts and written-instance counts also correlated with customer satisfaction. The respective raw correlations were −0.74 and −0.55, falling to partial r = −0.16 (p = 0.130) and −0.07 (p = 0.516) after adjustment. Neither adjusted comparison met the nominal threshold. Restriction to active engagements removes the already-canceled group, but the remaining shared-source and conditional-model limitations still apply.

5.3 Engagement Indicator Mean and Indicator Quintile

Study measure · Engagement indicator mean and indicator quintile · Full analysis in Part 1, The Engagement Indicator Mean and the Interdependence of the Four Measures, section 1

The score was strongly correlated with the mean of the 53 indicators outside it. This connects reported governance quality with the wider assessment of engagement performance and capability. The two measures use disjoint indicator sets, so the association is empirical rather than a literal overlap of items. Adjustment asks whether a relationship remains after accounting for that wider standing, with the limitations of the composite comparison stated explicitly.

The score correlated with the mean of the other 53 indicators at r = 0.94 (95% CI 0.92–0.95, n = 150 engagements). The strong empirical relationship explains why the adjusted comparisons are informative but also difficult to interpret. Accounting for a related composite can substantially alter a coefficient, and category composition affects what the adjustment removes.

Written instances fell from 29.27 per engagement in the lowest indicator quintile to 26.10, 21.47, 19.87, and 14.30 in the four quintiles above it, each quintile holding 30 engagements (Welch F = 57.16, Holm p < 0.001). Distressed governance ratings fell more steeply, from 201.63 per engagement in the lowest quintile to 167.17, 109.80, 45.17, and 12.03 (Welch F = 550.56, Holm p < 0.001). The highest quintile still carried written instances on all 30 of its engagements.

5.4 Intent to Leave

Study measure · Intent to leave · Full analysis in Part 4, Intent to Leave, section 1.1

Respondents reporting stronger intent to leave also reported substantially lower scores. This connects the control environment with the experience of the delivery workforce, particularly where staff describe manual correction, unresolved issues, and work that remains poorly visible to oversight. The comparison concerns stated intention, not subsequent departure. It also shares a respondent source with the score and does not identify the direction of the relationship.

Scores were 3 or below for 59.53% of the higher-intention group and 2.99% of the lower-intention group. The 430 respondents who rated their intent to leave at 7 or above stood at 2.86, the 368 below 7 at 5.35, and the 52 who gave no answer at 3.79 (Holm p < 0.001). Distressed governance ratings numbered 29.15 per respondent at 7 or above against 6.77 below 7, and written instances 4.71 against 2.99 (Holm p < 0.001).

Every failure category followed the same order. Co-management stood at 2.48 among respondents intending to leave against 5.04 among the rest, and the third-party ecosystem at 3.39 against 6.06. At the engagement level, the score was associated with intent to leave at r = −0.84 (95% CI −0.88 to −0.79, n = 150 engagements), and at the respondent level at r = −0.78 (cluster-robust p < 0.001, n = 798 respondents).

Intent to leave did not mark the lowest the score of the study. The canceled engagements stood lower, at 2.58, and so did the respondents who rated their own understanding of the governing obligations 1 to 3, at 2.41. Among the challenges that reduced their job satisfaction, respondents at intent to leave 7 or above named reported governance weaknesss directly. One individual contributor on a canceled engagement, who rated intent to leave at 10, named three.