Control library

9 of 18 controls passing

Controls carry a weight; overdue tests count for half. Record a result and the compliance score updates immediately.

weighted control score

HN-DL-01End-to-end feature lineage recordedPassing

Data Lineage · weight 1.5 · Consumer Credit Scoring v4 · Data Lineage & Quality Policy · last tested 2026-08-05 · next due 2027-02-05

HN-DL-02Training data retention and provenance checksPartial

Data Lineage · weight 1 · Card Fraud Detection Engine · Data Lineage & Quality Policy · last tested 2026-06-18 · next due 2026-12-18

HN-DL-03Data quality thresholds monitored dailyPassing

Data Lineage · weight 1 · AML Transaction Monitoring Assist · Data Lineage & Quality Policy · last tested 2026-09-01 · next due 2027-03-01

HN-EX-01Adverse action reason codes generatedPassing

Explainability · weight 1.5 · Consumer Credit Scoring v4 · Fair Lending & Model Fairness Policy · last tested 2026-07-28 · next due 2027-01-28

HN-EX-02Customer-facing explanation reviewPassing

Explainability · weight 1 · Branch Servicing Assistant (LLM) · Fair Lending & Model Fairness Policy · last tested 2026-09-13 · next due 2026-12-12

HN-FA-01Disparate impact testing by protected classFailing

Fairness · weight 1.5 · Consumer Credit Scoring v4 · Fair Lending & Model Fairness Policy · last tested 2026-06-30 · next due 2026-09-30

HN-FA-02Proxy variable screening in featuresPartial

Fairness · weight 1 · Collections Propensity Model · Fair Lending & Model Fairness Policy · last tested 2026-05-22 · next due 2026-11-22

HN-FA-03Fairness metrics tracked post-deploymentNot tested

Fairness · weight 1 · Marketing Next-Best-Offer · Fair Lending & Model Fairness Policy · last tested never · next due 2026-09-25

HN-MR-01Independent model validation before releasePassing

Model Risk · weight 1.5 · Consumer Credit Scoring v4 · Model Risk Management Standard · last tested 2026-07-14 · next due 2027-01-14

HN-MR-02Annual revalidation of production modelsPartial

Model Risk · weight 1.5 · Card Fraud Detection Engine · Model Risk Management Standard · last tested 2026-05-02 · next due 2026-11-02

HN-MR-03Model inventory completeness reconciliationPassing

Model Risk · weight 1 · AML Transaction Monitoring Assist · Model Risk Management Standard · last tested 2026-08-20 · next due 2027-02-20

HN-MR-04Documented model assumptions and limitationsFailing

Model Risk · weight 1 · Collections Propensity Model · Model Risk Management Standard · last tested 2026-04-11 · next due 2026-10-11

HN-RS-01Kill switch tested each quarterPassing

Resilience · weight 1.5 · Card Fraud Detection Engine · Model Change & Resilience Procedure · last tested 2026-08-12 · next due 2026-11-12

HN-RS-02Fallback rules engine availablePassing

Resilience · weight 1 · AML Transaction Monitoring Assist · Model Change & Resilience Procedure · last tested 2026-07-03 · next due 2027-01-03

HN-RS-03Change approval with rollback planPartial

Resilience · weight 1 · Consumer Credit Scoring v4 · Model Change & Resilience Procedure · last tested 2026-03-30 · next due 2026-09-30

HN-SC-01Least privilege access to model endpointsPassing

Security · weight 1.5 · Branch Servicing Assistant (LLM) · AI Security & Access Control Standard · last tested 2026-08-27 · next due 2027-02-27

HN-SC-02Prompt injection and output filtering testsFailingTest overdue

Security · weight 1 · Branch Servicing Assistant (LLM) · AI Security & Access Control Standard · last tested 2026-06-09 · next due 2026-09-09

HN-TP-01Vendor model due diligence refreshPartial

Third Party · weight 1 · Marketing Next-Best-Offer · Third Party AI Vendor Policy · last tested 2026-09-13 · next due 2026-12-12

DL-01Training data source registryPassing

Data Lineage · weight 3 · Credit Risk Scoring v4 · BCBS 239 Data Lineage & Provenance Policy · last tested 2026-08-30 · next due 2026-11-30

DL-02Feature lineage freshnessFailingTest overdue

Data Lineage · weight 2 · Fraud Detection Net · BCBS 239 Data Lineage & Provenance Policy · last tested 2026-08-05 · next due 2026-09-05

DL-03PII minimisation reviewPassing

Data Lineage · weight 2 · Customer Sentiment LLM · BCBS 239 Data Lineage & Provenance Policy · last tested 2026-09-01 · next due 2026-12-01

EX-01Reason codes for adverse decisionsPartial

Explainability · weight 3 · Credit Risk Scoring v4 · ECOA / Reg B Adverse Action Explainability Policy · last tested 2026-07-18 · next due 2026-10-18

EX-02Model card publishedFailing

Explainability · weight 2 · Customer Sentiment LLM · ECOA / Reg B Adverse Action Explainability Policy · last tested 2026-08-22 · next due 2026-09-22

EX-03Customer-facing disclosure copyNot tested

Explainability · weight 1 · Collections Outreach Agent · ECOA / Reg B Adverse Action Explainability Policy · last tested never · next due 2026-10-05

FA-01Group fairness testingFailing

Fairness · weight 3 · Credit Risk Scoring v4 · SR 11-7 Model Risk Management Standard · last tested 2026-08-14 · next due 2026-09-14

FA-02Proxy variable screeningPartial

Fairness · weight 2 · Collections Outreach Agent · SR 11-7 Model Risk Management Standard · last tested 2026-08-01 · next due 2026-11-01

MR-01Independent model validationPassing

Model Risk · weight 3 · Credit Risk Scoring v4 · SR 11-7 Model Risk Management Standard · last tested 2026-08-12 · next due 2026-11-12

MR-02Challenger model benchmarkingPassing

Model Risk · weight 2 · Credit Risk Scoring v4 · SR 11-7 Model Risk Management Standard · last tested 2026-08-20 · next due 2026-11-20

MR-03Performance monitoring thresholdsPartial

Model Risk · weight 2 · Fraud Detection Net · SR 11-7 Model Risk Management Standard · last tested 2026-07-02 · next due 2026-10-02

MR-04Annual revalidation sign-offNot tested

Model Risk · weight 2 · Collections Outreach Agent · SR 11-7 Model Risk Management Standard · last tested never · next due 2026-09-30

RS-01Kill-switch drill executedPassing

Resilience · weight 3 · Fraud Detection Net · FFIEC AI Incident Response Runbook · last tested 2026-09-05 · next due 2026-12-05

RS-02Rollback plan rehearsedPassing

Resilience · weight 2 · Credit Risk Scoring v4 · FFIEC AI Incident Response Runbook · last tested 2026-08-28 · next due 2026-11-28

RS-03Incident post-mortem within 5 daysFailing

Resilience · weight 1 · Wealth Robo-Advisory Pilot · FFIEC AI Incident Response Runbook · last tested 2026-08-19 · next due 2026-09-19

SC-01Prompt injection test suitePassing

Security · weight 2 · Customer Sentiment LLM · FFIEC AI Incident Response Runbook · last tested 2026-09-02 · next due 2026-12-02

SC-02Access review for model endpointsPassing

Security · weight 2 · Fraud Detection Net · FFIEC AI Incident Response Runbook · last tested 2026-08-27 · next due 2026-11-27

SC-03Secrets rotation for agent keysPartial

Security · weight 1 · Collections Outreach Agent · FFIEC AI Incident Response Runbook · last tested 2026-07-30 · next due 2026-10-30

TP-01Vendor model due diligencePartialTest overdue

Third Party · weight 2 · Wealth Robo-Advisory Pilot · OCC 2013-29 Third-Party Model Assurance · last tested 2026-06-11 · next due 2026-09-11

TP-02Contractual audit rightsPassing

Third Party · weight 1 · Customer Sentiment LLM · OCC 2013-29 Third-Party Model Assurance · last tested 2026-07-25 · next due 2027-01-25