Skip to paper content

AAO-034 / Assurance and Audit

Outsourced Reporting Agents Need Source to Filing Lineage

A Practical Evidence Method for Bank Reporting

Bank reporting managers should preserve a trace from source data through transformations, human corrections, approval, and the filed version. An agent-generated explanation cannot substitute for evidence of how the reported figure was produced.

Download paper PDFRead online ↓
Title page: Outsourced Reporting Agents Need Source to Filing Lineage — A Practical Evidence Method for Bank Reporting. Phil Hatch, Akholi, October 23, 2026.

Make the Filed Result Reconstructible

The bank reporting owner should require the outsourced service to reconstruct a reported item from its original source to the submitted version. The evidence must show data meaning, transformations, assumptions, exceptions, human corrections, and approval. A fluent narrative about the calculation is insufficient if it cannot be connected to the actual inputs and operations.

The study reports tool success messages inconsistent with completed work and manual changes across sampled engagements.1 These accounts do not establish errors in a particular filing. They identify reasons to test the reporting service’s evidence rather than accept its completion status as proof of accuracy.

Select a material reporting item and follow it in both directions. From the source, identify every transformation and aggregation. From the filed figure, identify the records and decisions that produced it. Differences between those routes should remain unresolved exceptions until the bank can explain them.

Preserve Meaning Alongside the Number

A field name is not a complete definition. Record the unit, currency, period, entity, inclusion rule, valuation basis, and treatment of missing or corrected data. An agent can map similar labels while changing meaning. The reporting owner should approve the mapping and identify which differences require specialist judgment.

A hypothetical exposure report may combine an outstanding balance with a credit limit because both source fields are labeled amount. The arithmetic can be internally consistent while the reported concept is wrong. The lineage record should preserve the definition and mapping decision, not merely the numeric values before and after transformation.

The provider should identify where it inferred, extracted, calculated, or copied information. Those operations require different tests. An inferred classification should not enter the record as if it were an observed source fact, and an unavailable value should not be silently replaced with a plausible number.

Use a Source to Filing Evidence Record

Figure 1 proposes four linked layers: source, transformation, intervention, and submission. Give each material item a stable reference so the bank can connect its lineage across systems. Retain the model and workflow version where needed to explain the processing, while using authoritative data and action records to establish what occurred.

Human corrections should preserve the original value, changed value, reason, authority, and time. The evidence should distinguish fixing a source error from overriding a policy or changing the presentation of performance. A corrected output may be acceptable, but the correction must not disappear from the record used to assess the service.

FINMA’s AI guidance identifies documentation and independent review among relevant supervisory observations.2 Applied to this reporting service, management should require a reviewer to reproduce selected material items from the preserved evidence. That proposed acceptance test is specific to the service, rather than a claim that the guidance prescribes this exact record.

The source to filing evidence chain. Source; Definition value entity and period; Is the intended fact represented. Transformation; Mapping rule and workflow version; Can the figure be reproduced. Intervention; Original correction reason and approval; Is human work traceable. Submission; Approved filed and acknowledged version; Did the intended filing arrive. Author’s proposed operating framework. Adapt to the service and applicable jurisdiction; not an empirically validated standard.
Figure 1. The source to filing evidence chainPhil Hatch, proposed framework developed for this paper.

Control the Submitted Version and Later Corrections

Identify the version approved by the bank and the version received by the filing destination. A successful generation or upload attempt should not be treated as accepted submission without the relevant acknowledgment. Preserve failed attempts, resubmissions, and the reason for any difference between the approved and submitted files.

When an error is discovered, the bank reporting owner should determine materiality, correction, escalation, and any required notification under the applicable regime. The provider should preserve evidence and support the decision. It should not independently decide that a correction is immaterial merely because the service contract measures output volume.

EU, UK, Swiss, and US reporting obligations differ by entity, report, and activity. Record the applicable definitions, retention, approval, and filing conditions. The same technical lineage method can support several regimes, but a common data label should not imply that the local reporting concepts are identical.

Accept Reporting Evidence Rather Than Output Volume

Morgan Lewis’s outsourcing analysis emphasizes defined transformation responsibilities and measures of success.3 The bank should therefore make reconstructibility and correct submission part of acceptance, alongside timeliness and quality. A count of generated reports should not close a service obligation when material items remain unexplained.

A practical objection is the cost of retaining every intermediate artifact. Set retention and detail according to materiality, reproducibility needs, privacy, and applicable obligations. The bank must still retain enough evidence to explain a material reported result. A retention reduction that removes that ability should be an explicit risk and compliance decision.

Before production acceptance, reconstruct representative normal, corrected, missing-data, and resubmitted cases. Assign owners to gaps and retest the affected route. The manager should approve the service when a material filed result can be traced to its source and governing decisions, including the work people performed to make it correct.

Evidence and Source Note

The study is a nonrepresentative cross-section of 850 vendor delivery-team respondents on 150 engagements serving Tier 1 financial institutions, collected during January–June 2026. Neither banks nor vendors corroborated the accounts. It establishes reported experience, not causation, legal breach, or market prevalence. The author-supplied version 1.8.2 is dated November 1, 2026 and is cited as a forthcoming manuscript consulted October 23, 2026.4

This is an analytical decision paper based on the supplied study and selected primary public sources checked through October 23, 2026. The original contribution is a source-to-filing evidence method preserving data meaning, transformations, manual corrections, approval, and the acknowledged submission version. The proposed method has not been independently validated. Legal requirements depend on the entity, activity, jurisdiction, and effective provisions; supervisory observations, research, and professional commentary have distinct authority.

Notes

  1. Phil Hatch, Agentic AI Outsourcing at Tier 1 Financial Institutions: Full Study Report, version 1.8.2 (Akholi, forthcoming manuscript dated November 1, 2026), Part 3, AI Technology, sec. 4.1, “Accuracy of the Tools’ Own Success and Failure Reports,” indicator C172, https://doi.org/10.2139/ssrn.7164559; Hatch, Agentic AI Outsourcing, Part 5, “The Five Manual Alteration Methods” and “Disclosure of Manual Alteration,” table 5.8. ↩
  2. Swiss Financial Market Supervisory Authority, Governance and Risk Management When Using Artificial Intelligence (Swiss Financial Market Supervisory Authority, December 18, 2024), FINMA Guidance 08/2024, secs. 2.1–2.7, https://www.finma.ch/~/media/finma/dokumente/dokumentencenter/myfinma/4dokumentation/finma-aufsichtsmitteilungen/20241218-finma-aufsichtsmitteilung-08-2024.pdf?hash=60E2745D7AC1D7F4E06CE43474539F68&sc_lang=en. ↩
  3. Barbara Murphy Melby et al., “AI-Enabled Outsourcing: Key Contract, Pricing, and Governance Considerations,” Morgan Lewis, July 2026, public report overview and key takeaways, https://www.morganlewis.com/pubs/2026/07/ai-enabled-outsourcing-key-contract-pricing-and-governance-considerations. ↩
  4. Hatch, Agentic AI Outsourcing, Introduction, “Executive Summary” and “Evidentiary Basis and Its Limits”. ↩

Bibliography

Continue your review

Read the full study, examine its evidence and limitations, or find another paper for your decision.

Browse all papers