Governance, Oversight, and Risk
A comprehensive, independent audit of the outsourcing and GCC estate across governance, oversight, and risk, ending in a board-grade verdict and a corrective action plan across all three pillars.
Buyer-held · the whole estate · nothing to sell into it
The board’s assurance is written by the parties it is meant to govern
The board is accountable for a large, growing estate of outsourcing and global capability center arrangements it governs at arm’s length. The assurance it receives is authored by the parties being governed: the vendor, the captive, the champion, or an advisor that also builds, runs, or sells the work. The independent-challenge discipline that governs a credit model and a financial audit, a review by a party with no stake, has not reached that estate. The stakes are highest where the work takes autonomous action, and more of the contracted and captive work now does, faster than it can be overseen. The offering is a comprehensive, independent audit across governance, oversight, and risk, ending in a board-grade verdict with a corrective action plan across all three pillars.
- The board governs the estate at arm’s length, on the governed party’s own word. Supervisory expectations for model risk were written for static models that estimate, not for work that takes actions. Regulators expect oversight that is real, a reliable way to stop the work; not understanding a system one has deployed is not a defense. In the Akholi study of outsourcing engagements, every engagement, 150 of 150, named at least one governance, oversight, or risk issue among its top problems, and those questions are the same whether the work is outsourced or held in a captive.
- Governance: who owns the arrangements and the decisions inside them. In the study, ownership and accountability for the AI in the work rated 3.5 of 10, with about half the ratings distressed. Who decides what an agent may do without human approval rated 3.6. Governance is often a policy on paper without an owner in the room.
- Oversight: real control of the providers and captives, or only nominal. The capacity to oversee the AI in the work rated 3.5 of 10; the speed to stop a misbehaving agent rated 3.6. The agent black box, the inability to reconstruct what an agent actually did across the boundary, was a most-damaging issue in 124 of 150 engagements. A sign-off with no capacity to intervene is not oversight.
- Risk: the residual exposure across the estate. Delivery staff rated their own client-facing reporting more likely manipulated, 6.3 of 10, than accurate, 4.8; nearly two-thirds put the likelihood of manipulation at 6 of 10 or higher. The business case, KPIs, and ROI definition rated 3.5 of 10 for stability. Work that acts on its own can act wrong at machine speed. What cannot be quantified must be bounded by control, not by a number.
The audit in brief
The Control Read
The Control Read, phase by phase
Frame — the executive-sponsor kickoff
The audit opens with the executive sponsor. Akholi and the sponsor fix the board question the audit must answer. The sponsor sets the institution’s own adequacy bar, the control standard the estate must clear to justify the authority it holds. The halt criteria are named up front. Halt is a live outcome from the start.
Inventory — the true estate
Akholi establishes the true estate on the institution’s own evidence, not a provider registry. The inventory covers the providers, the captives, and the work and agents inside them, and reaches the ungoverned and shadow AI already in regulated workflows. Akholi names the executive accountable for each consequential arrangement and agent.
Probe — score the three pillars across the estate
Akholi scores the estate against the adequacy bar across the three pillars, on the institution’s own evidence. The providers’, captives’, and agents’ self-reports are treated as subjects of audit, not sources of truth. Governance: ownership, decision rights, and the mandate, including what the AI may do. Oversight: real human control, the authority and speed to stop, and visibility across the boundary. Risk: concentration, reporting integrity, the business case, and the agentic dimension. A reporting-integrity test asks whether green reflects real control or a report the governed party authored about itself.
Stress — size the residual risk
Akholi sizes the residual risk in board language, including the risk that cannot be quantified. Akholi asks whether the institution could survive a control failure it cannot currently see. Work that acts on its own is tested at the speed it acts.
Decide — the verdict against the bar
Akholi returns the verdict against the adequacy bar and the halt criteria. It resolves to one of three doors. Clear: the estate meets the bar. Remediate: a prioritized corrective action plan across governance, oversight, and risk, with an oversight redesign that is real, not nominal. Halt: the specific arrangements or agents to stop or roll back until control is restored. The sponsor holds the verdict and the decision.
The Control Read fits an institution where
- A large outsourcing and GCC estate is governed at arm’s length.
- The board carries non-transferable accountability for the work inside it.
- The assurance on offer comes from the parties being governed.
- More of the contracted or captive work now takes autonomous action.
- Halt is worth putting on the table for any arrangement that cannot meet the bar.
The Practice
All offerings →Crisis Response
An engagement in acute failure. A senior Akholi principal takes command within 24 hours.
Outsourcing Performance Tuning
A buyer-held read of a live, underperforming engagement across all five failure categories.
The Practice
Independent reads and board-grade verdicts across the outsourcing and GCC lifecycle.