01
Decision accountability
The property of a decision being traceable, after the fact, to the evidence it rested on, the person who approved it, and the person who owns its outcome.
The test
Pick your most consequential decision of the last quarter. Can you produce, without asking the people involved, what it was based on, who approved it, and who is accountable for the result? If retrieval requires human memory, the property is absent.
Most governance effort is spent on whether a decision was correct. Accountability is a separate and more durable property: a decision can be wrong and still be well governed, and right and still be indefensible. Regulators, boards and acquirers test the second.
See also: Evidence trail, Decision owner
02
Model governance vs decision governance
Model governance controls the behaviour of a model — its data, drift, bias and access. Decision governance controls what an organisation does as a consequence — who approved acting on the output, on what basis, and who carries the result.
The test
Ask who signed off the model, then ask who signed off the decision it informed. If the same artefact answers both, the second question has not been governed.
An organisation can hold a complete model inventory and still be unable to defend a single decision, because the decision is made by people acting on the output rather than by the model itself. The two are commonly conflated, and the gap is where liability sits.
See also: Decision accountability
03
Evidence trail
An append-only record of what a decision was based on, produced automatically as a by-product of the decision rather than assembled afterwards.
The test
Was the record created at the time of the decision, or reconstructed when it was requested? Reconstructed evidence is testimony, not evidence.
Evidence assembled on request is unreliable in exactly the circumstances where it matters, because the assembly is done by people with an interest in the outcome. Automatic capture removes that incentive entirely.
Provenance: The append-only and tamper-evidence requirements are conventional in financial audit; hash-chaining as a tamper-detection mechanism predates blockchain and is standard in secure logging.
See also: Tamper-evident log, Decision accountability
04
Tamper-evident log
A record in which each entry commits cryptographically to the one before it, so any later alteration is detectable even by someone who trusts nobody administering the system.
The test
If a database administrator edited a historical row, would anyone find out? If the answer relies on access control or policy rather than on the structure of the record, the log is tamper-discouraging, not tamper-evident.
Access control prevents alteration by those without access. Tamper evidence detects alteration by those with it — which is the threat model that matters for a log intended to defend the organisation.
Provenance: Hash-chaining; standard practice in secure logging and audit systems.
See also: Evidence trail
05
Decision owner
The single named role accountable for the outcome of a decision, distinct from whoever proposed, analysed or approved it.
The test
Name them. If the answer is a committee, a function, or "the business", the decision has no owner — it has an audience.
Ownership distributed across a group is ownership held by nobody. A named role also survives the departure of the individual, which a named person does not.
See also: Decision accountability, Segregation of duties
06
Segregation of duties
A control in which the person who requests an action cannot be the person who approves it.
The test
Try to approve your own request in the system that matters most. If it succeeds, the control is decorative.
Self-approval removes the only independent check on a request, and it is the default state of most internal tooling because it is the easiest to build.
Provenance: A long-established internal-control principle in accounting and auditing; not original to us.
See also: Dual control, Decision owner
07
Dual control
A requirement that two authorised people act before an irreversible action proceeds.
The test
Identify your most irreversible automated action. Does it complete on one person's authority? If so, you have single control over an outcome you cannot undo.
Reversibility, not severity, is the right trigger. An action that can be undone tolerates a single mistake; one that cannot does not.
Provenance: Standard in payments, key management and physical security.
See also: Segregation of duties
08
Cost of inaction
The quantified consequence, expressed as currency per unit of time, of leaving an identified recommendation unactioned.
The test
For your oldest open recommendation, state what one more month of delay costs, with the assumptions shown. If deferral has no price, it will be chosen by default.
Risk registers price what happens if something goes wrong and almost never price doing nothing, so "we will revisit next quarter" appears free. Making it visible changes which deferrals survive scrutiny.
See also: Recommendation lifecycle
09
Recommendation lifecycle
The tracked progression of a recommendation from proposed through accepted, in progress and done — or explicitly dismissed with a recorded reason — such that it cannot silently lapse.
The test
Take a recommendation made to your organisation eighteen months ago. What state is it in? If nobody can say, recommendations are not being tracked, they are being received.
Advice with no status, owner or due date reliably evaporates between review cycles, which is why the same strategic question is commissioned repeatedly. Requiring a written reason to dismiss changes behaviour more than any dashboard.
See also: Cost of inaction, Decision owner
10
Provenance-constrained output
Generated text in which every numeric figure must trace to a value present in the input, with the output rejected and regenerated when it cannot.
The test
Ask a generative system for an analysis containing figures. Can it produce a number that appears nowhere in what you supplied? If yes, its numbers are unverified regardless of how confident the presentation is.
A fabricated figure is more dangerous than fabricated prose because it survives summarisation, reaches a board pack, and is acted upon. Constraining numerals is a narrower and far more tractable problem than constraining all generated claims.
See also: Surfaced disagreement
11
Surfaced disagreement
The practice of showing a user where two independent models diverge on the same question, rather than resolving the divergence silently into one answer.
The test
When your system produces an answer, can you tell whether that answer was contested? If not, uncertainty has been removed from the output rather than from the world.
Divergence between competent independent analyses marks the places a human should look hardest. Averaging or arbitrating it away yields a cleaner artefact and a worse decision.
See also: Provenance-constrained output
12
Operating evidence
Proof that a control has actually run, repeatedly, over a period — as distinct from proof that a policy describing it exists.
The test
For any control you claim: can you produce dated records of it operating on at least three separate occasions? A policy document, however well written, is not operating evidence.
The distinction between documented, approved and operating is the whole substance of an audit. Only the third takes time, cannot be compressed, and cannot be created retroactively — which is why starting an imperfect control now beats designing a perfect one later.
Provenance: Mirrors the design-versus-operating-effectiveness distinction in SOC 2 (Type I vs Type II) and ISO management-system auditing.
See also: Evidence trail