The question that takes a week
The Audit Committee chair turns to the Chief Risk Officer (CRO) with a question about one material risk. Which controls cover it? How do we know they work? Who signed off the exception that is still open?
The CRO knows the controls exist. The business owns the risks and controls, while fraud, operational risk and compliance functions oversee different aspects of them, describe them in their own terms and keep the evidence in their own systems.
An answer that should take an afternoon takes a week. Analysts drop their day jobs to rebuild evidence the institution already holds. Three versions of the same control end up on one slide, and the CRO presents it knowing how thin it is. Nobody books the cost of that week, and the next question brings another one like it.
None of this came from a bad decision. Different owners made reasonable ones, years apart and for different reasons. Added up, those decisions left the CRO with more controls than ever and less ability to defend any of them.
Call it assurance debt: the gap between how many controls an institution has and how well its leaders can explain them. Because nobody books it, a CRO can carry more of it than they can see, and AI is about to compound it. The answer is to connect the controls already in place. Adding more only deepens the debt.
Time it. How long does it take to defend one material risk?
How assurance debt builds
A review finds a coverage gap, and someone adds a control. An auditor wants evidence in a new format, so a new collection routine starts. An automation pilot takes over a task, and someone wraps a check around it.
Each fix is defensible. Each also borrows a little against the CRO's ability to explain the control environment from end to end.
Like technical debt, assurance debt slows everything built on top of it, and it falls due the moment someone asks for proof. Then the CRO pays interest in war rooms, in evidence requested for the third time, and in remediation that closes the finding but leaves its cause in place.
Ten years after the Basel Committee published its risk-data principles, its 2023 review found only two of 31 global systemically important banks fully compliant. The European Central Bank (ECB) reports that problems with data accuracy, completeness and timeliness "are still widely encountered," and that losses caused by poor data quality "are rarely captured in a systematic manner." Assurance debt stays hidden for the same reason. No budget line records it, so no one is asked to pay it down.
Why the debt is coming due
A thick control inventory once passed for diligence. Supervisors now want the evidence behind it, and a name attached.
Accountability is becoming personal. The ECB's 2024 guide expects a bank's management body to take full responsibility for risk data. It recommends naming one or two members of that body, such as the CRO or CFO, to executive accountability for risk data aggregation and risk reporting and raises the prospect of reassessing their fit and proper if progress stalls. Even in the UK, where the 2026 reforms to the Senior Managers and Certification Regime cut paperwork, the core held. Named senior managers remain individually accountable.
Enforcement is reaching data and control foundations. In July 2024, the Federal Reserve and the Office of the Comptroller of the Currency fined a large US bank a combined $135.6 million for insufficient progress on data quality management and for failing to put compensating controls in place.
Resilience rules add layers. The EU's Digital Operational Resilience Act (DORA) has applied since January 2025 and requires EU banks, insurers and investment firms to keep a register of information covering contractual arrangements for the use of information and communication technology (ICT) services provided by ICT third-party service providers. UK banks and insurers had until March 2025 to show they could stay within impact tolerances for important business services. EU insurers now carry DORA's requirements on top of the internal control system Solvency II has mandated since 2016
No single rule here creates assurance debt. The trouble is how the rules land. Each arrives with its own controls and evidence requests, owned by someone new, in a control environment with no common way to connect them to what is already there.
Inside the institution, four different questions trace back to the same disconnected controls. The CFO asks whether the firm pays several times for similar control work. The CIO worries that another platform will become its own silo. The COO needs to know who does the work, because most controls run inside operations. The Board wants to know whether management's conclusions will survive challenge. All four land on the CRO's desk.
Not all duplication is debt
Defense in depth puts more than one control on the same risk by design. Second-line testing and Internal Audit are meant to re-examine the first line's work. A CRO who cut that overlap would weaken the institution.
What separates designed redundancy from debt is whether anyone can explain the overlap. Designed redundancy has a documented reason and a named owner. Debt has neither.
The working rule: if you can't say why the overlap exists and who owns it, it's debt.
The four-line test
Pick one material risk or obligation. Ask the teams who own it for four lines:
- The obligation or risk statement that requires action.
- The control objective and the specific implementation that addresses it.
- Current evidence that the control is well designed and operating effectively.
- The accountable decision, exception or remediation status.
Don't assemble a project team. The point is to see what the institution can produce as it stands.
If the answer comes back quickly and every function gives the same four lines, the controls on that risk are connected. If it takes a war room, people are compensating for controls that don't connect. More effort won't fix that.
Time to defend
Now time it. For one material risk, time to defend is the elapsed time between the question and a four-line answer that every function involved accepts.
Connecting controls, evidence and accountable decisions should reduce the effort required to reconstruct an assurance position. Institutions can test this proposition by baselining their current ‘time to defend’, meaning the elapsed time and effort required to answer a material assurance question with complete and traceable evidence, and then measuring improvement as the control fabric matures. That makes it a more honest test of control health than inventory size or test counts, and one a Board member can read it without a briefing pack.
Time to defend tells you how much debt sits on a risk. Person-hours tell you what it costs. Start with the week it took to answer the chair. Count the people pulled in, multiply by the hours each spent at loaded cost, then by the number of times a year the institution must defend a material risk to its Board, auditors or supervisors. Add the duplicate work, where two or three functions each run their own version of a control with the same objective and nobody can say why. Add the evidence rebuilt because nobody trusts what the institution already holds. Add the findings that come back within a year because remediation closed the ticket, not the cause. Treat the total as a floor and set it against what the institution spends running and testing its controls. That is the cost nobody booked, and the CFO's question about paying several times for similar control work now has a number.
Where the clock runs
A slow answer usually stalls in a few familiar places:
- The same control has different names. Each function describes it in its own terms, so the first hours go on working out whether two lists mean the same thing.
- Nobody trusts the evidence. It was never tied to a stable control identifier, so teams request it again rather than rely on it.
- Issues sit in separate workflows. One recurring weakness appears as unrelated findings in different functions, and the root cause stays hidden.
Share the meaning, not the accountability
Reducing the debt doesn't mean pulling every control into one function. Fraud specialists, compliance teams and Internal Audit work separately because each applies a different judgment. Merging them would trade one risk for another.
The line to draw is between accountability and meaning. Business owners keep their risks and controls. The second line keeps its independent challenge, Internal Audit its assurance, and specialists their reading of each jurisdiction's rules. People, not systems, approve material risk acceptance, exceptions and compliance conclusions.
What the functions share is narrower and more mechanical. Each control has one identifier and a minimum set of attributes. Risks, obligations and controls are linked in an agreed way. A single evidence standard records where each item came from, who can see it and how long it's kept.
In practice, the shared layer is a control register with stable identifiers and agreed links, often inside the governance, risk and compliance (GRC) platform the institution already licenses, with evidence referenced where it sits rather than copied. It runs across existing systems of record without replacing them, which answers the CIO's concern about another silo. Get it right and anyone can trace a material risk through its controls and evidence to the person who decided.
The shared control layer should be governed jointly, not owned exclusively by a single function.
Executive accountability typically belongs with the CRO or an equivalent enterprise risk leader, supported by a Control Governance Council. Its members should include representatives from the business or first line, Risk, Compliance, Finance, and Technology and Data, with Internal Audit represented where appropriate. The council governs the shared control language and standards, while accountability for individual risks, controls and decisions remains with the designated owners. Disputes are settled at the lowest level that can resolve them, between the accountable control and risk owners. When a question of interpretation affects several functions or materially changes risk coverage, it goes to the council. If a material-risk decision is still unresolved there, the accountable executive makes the call. Day-to-day control changes stay with their owners and do not need the council's approval.
The principle is simple: federate accountability, but govern the shared language centrally.
AI inherits your taxonomy
Ask a model to map a new obligation to existing controls, and it can only work with the identifiers and links people have already agreed. Give it three functions' conflicting descriptions and it will return three answers, faster. It will also raise a question nobody has settled: who owns the model's conclusion?
Regulators haven't settled that question either. In April 2026, US banking regulators replaced the model risk guidance banks had followed since 2011 and explicitly left generative and agentic AI out of scope.[8] In the EU, AI used to assess creditworthiness, or to price life and health insurance for individuals, is high-risk under the AI Act, with obligations applying from December 2027.[9] The US has left the question open, and the EU has set a deadline. Neither resolves it for your institution, so settle it internally. A named owner signs off each AI-assisted control conclusion, and the CRO answers for how those sign-offs are governed.
A model inherits whatever people have agreed, so the agreement comes first: meaning, then the evidence standard, then the workflow, then any platform changes. Scale AI last. One use can come earlier, though. Flagging controls that look alike helps owners reach that agreement in the first place.
Introduced in that order, AI can help expose the debt, and the coverage gaps it hides, in three ways:
- Mapping new obligations. It reads regulatory obligations, policies and existing controls, and proposes links between them. The accountable control or compliance owner validates, modifies or rejects the proposed mapping.
- Flagging overlap. It compares control intent, risk coverage, execution and evidence across functions, and flags controls that look alike. The relevant risk and control owners decide whether each overlap is designed redundancy, debt or a sign of a coverage gap.
- Checking evidence. Before formal testing, it flags missing evidence, inconsistent attributes, stale artifacts and breaks in the evidence chain. The accountable tester, control owner or assurance professional determines whether the evidence is sufficient and whether remediation is required. In each case, AI proposes, prioritises and explains. A named human remains accountable for the decision.
The first move
Start with one risk:
Run the four-line test this week on a risk chosen without notice, so nobody prepares the answer, and record your time to defend.
- Sort designed redundancy from debt for that risk. Keep the overlap you can explain and challenge the rest.
- Agree one shared control language and one evidence standard for that risk alone, using identifiers designed to extend across the enterprise. Then time the test again, run it on a second risk chosen without notice to confirm the change holds, and take the results to the Audit Committee with what the difference costs.
- Decide whether to extend it. If time to defend falls, extend the same approach one risk area at a time. Each extension needs an owner, a baseline Finance has confirmed, and a value case that counts each benefit once. If it doesn't fall, find out why before spending more.
Back in the boardroom
The chair asks the same question about the same risk. This time, the CRO turns to the accountable owner, who answers that afternoon, from evidence every function already uses, with a record of who decided what.
My team at Wipro Consulting runs the four-line test with risk leaders across banking and insurance. The first time is usually the most revealing.
In our work with risk leaders, the first attempt to answer this question is often the most revealing. It exposes where control language, evidence and accountability remain fragmented across functions.
