Accountability for automated work

No orphan systems

A model without a named owner cannot be entered in the inventory, and a model that is not in the inventory cannot be used for any decision. The rule is absolute and it is enforced at the platform level: the systems on which models run refuse to schedule a job for an unregistered model. There is no route by which an unowned system reaches production work.

The owner answers for the model being fit for its purpose, for its inputs being current and lawfully held, for its outputs being used only inside the approved scope, and for stopping it when it fails. Ownership sits with a person because a team can dissolve, a vendor can be replaced and a committee can disagree with itself, while a name on a register cannot do any of those things.

When an owner leaves the group or changes role, a successor is named before the change takes effect, or the model is suspended on the day of the change. Eleven ownership transfers were recorded in the twelve months to 30 June 2026 and none required a suspension. The inventory carries the date of every transfer and the name of the person who approved it.

The accountability record

For each model the group keeps a single record that answers four questions: who built it, who validated it, who owns it and who authorised its use. For each approved use of a learning system the record adds a fifth: which member of the Executive Committee answers to the Board for it. The five answers are names, with dates.

The accountable executive is expected to be able to explain what the system does and what it cannot do, in plain language, without the team that built it in the room. That expectation is not a formality. Two proposals in the twelve months to 30 June 2026 were deferred by the Council because the executive putting them forward could not describe the limits of the system.

The record can be produced to a client whose mandate the system touched, to the supervisor of a licensed entity that relies on it and to Internal Audit. It is retained for ten years after the model is retired, alongside the validation reports and the monitoring history, in the George Town archive.

When the work is wrong

A model that fails does so quietly, which is why the group treats detection as an accountability question rather than a technical one. The owner reports a threshold breach the day it is seen. The validation unit grades the finding. A grade one finding stops the model until it is closed. A grade two finding permits use under a written restriction with a closure date not more than 90 days out.

Where a client was affected, the group tells the client what happened, what it has done and what the client can do, in the next report or sooner if the matter will not wait. Where a valuation was wrong, the Risk & Valuation Committee restates it. Where an allocation was wrong, the position is corrected at the group cost rather than the client cost.

Consequences that reach people

Model ownership and Charter compliance are conduct and control objectives for every owner, for the heads of the Quantitative Strategies and Information & Data divisions and for the accountable executives. The Remuneration Committee applies malus where a breach was known and not escalated, where a model was used outside its scope, or where an incident was reported late.

That link is the reason the register is accurate. A control that costs nobody anything is a description rather than a control. Failure to submit a new system for review before committing resources to it is a breach of the Code of Conduct and is treated as one, whatever the quality of the work that followed.

Owners attest once a year that their inventory entries are complete and current, that the inputs remain lawfully held and that the model has been used only inside its scope. Attestation was 100 per cent of owners at 30 June 2026. Internal Audit tests a sample of attestations against the monitoring records on a two-year cycle.