Governing AI in financial analysis

0:00 A transposed digit and an investment committee

An analyst uses an AI assistant to draft an investment memo. It reads beautifully. It quotes an equity IRR of fourteen point two per cent. The locked model says twelve point four. The AI had picked up the digits from an earlier draft and transposed them. If that memo had reached the investment committee unchecked, a decision might have been made on a return that didn't exist. In this lecture you'll learn why AI needs explicit controls in financial work, a seven-part governance framework, how to tier uses by risk, how model risk management practices apply, what an audit trail should record, and practical validation techniques. By the end, you'll be able to write a one-page AI policy for a project finance team that's light enough to use and strong enough to catch errors like that one.

1:00 Why it matters

Why does governance matter more in finance than in many other uses of AI? Because models and reports drive investment decisions, lending, public spending and disclosures to investors. Errors cause financial loss, regulatory problems and reputational damage. And AI introduces new kinds of error. It makes confident mistakes that read exactly like correct statements. And its outputs can differ from one run to the next, so you can't assume yesterday's answer is today's. Financial regulators in many jurisdictions already expect firms to manage model risk and, increasingly, AI risk. So a team that can show clear controls isn't just safer. It's easier for auditors, lenders and regulators to trust.

1:47 The concept: the framework

Here's a seven-part framework. One, policy: which AI tools are approved, for which tasks, with what data. Two, risk tiering: classify uses by their impact. Three, human review, proportional to risk, by qualified reviewers. Four, an audit trail: record inputs, prompts, outputs, changes and approvals. Five, validation: test AI-supported calculations against independent methods. Six, confidentiality and privacy: protect deal data and personal data. And seven, monitoring and learning: track the errors found in review and improve prompts, tools and training. Think of it like the four-eyes principle that finance teams already use for payments, extended to a new kind of contributor. Nothing here is exotic. It's ordinary financial control, applied deliberately to AI.

2:36 Risk tiers

Now the tiers. Low: summarising public market research. A spot check and cited sources are enough. Medium: drafting variance commentary, or extracting terms for internal screening. That needs a full review against the source, with changes recorded. High: formulas in a lender model, figures in an investment committee paper, or a covenant compliance certificate. That needs an independent check, reconciliation to locked model outputs, and documented sign-off. And not permitted: autonomous decisions on investments, lending or covenant waivers. The key idea is that the tier depends on how the output will be used. The same assistant might produce a low-tier summary in the morning and a high-tier memo in the afternoon, and the review has to follow the use.

3:28 Worked example one: the audit trail entry

Let's look at a simple audit trail entry. Task: draft the DSCR commentary for the third-quarter lender report. Tool and version: the approved assistant, with its version. Inputs: model version four point two outputs, locked, and validated third-quarter operating data. Prompt: the standard lender commentary template. AI output stored: yes, with a link. Reviewer: named. Checks: every figure reconciled to the model; causes confirmed with the asset manager. Edits: corrected an availability figure, and removed a speculative statement about next year. Approved by: the finance director, with a date. It takes two minutes. And notice a subtle control: the inputs were locked model outputs. Feeding draft or unlocked model versions to an AI tool is one of the easiest ways to get a confidently wrong report.

4:23 Worked example two: the Karachi memo

Now the example from the start, which comes from the lesson. An analyst at a fictional Karachi-based advisory firm used AI to draft an investment memo, which quoted an equity IRR of fourteen point two per cent. The reviewer reconciled it to the locked model output: twelve point four. The AI had transposed digits from an earlier draft. What caught it wasn't brilliance. It was policy. The firm's rule said every figure in a high-tier document must be reconciled to the locked model, so the reviewer checked numbers, not just wording. That's the most important lesson in this lecture. Reviewers naturally read for tone and flow. In finance, the review has to include a line-by-line reconciliation of every number, or it isn't really a review.

5:17 Watch me do it: reconciling a document to the model

Let me show you a small automation that makes that reconciliation faster. I export the key outputs from the locked model into a simple file: equity IRR, project IRR, minimum DSCR, average DSCR, LLCR, debt size, NPV. Then a short script reads the draft memo, finds every number with a percentage sign, an x for ratios, or a currency, and tries to match it against the model outputs within a small tolerance. It prints a table: the number in the memo, the closest model output, and whether it matches. Anything unmatched is flagged for the reviewer. It won't understand context, so a human still decides whether each flag is a real error. But it turns a tedious line-by-line check into a two-minute task, which means it actually gets done every time.

6:14 Model risk management and regulation

Many financial institutions already apply model risk management frameworks, and banking supervisors in several jurisdictions have issued model risk guidance. The core practices apply equally to project finance models and AI tools. Keep an inventory with owners and purposes. Validate independently before use in decisions. Document assumptions, limitations and known issues. Control changes with versioning and testing. And review periodically, including back-testing any machine-learning forecasts against actuals. On regulation, the landscape keeps evolving. The EU AI Act takes a risk-based approach; the UK relies on principles applied by sector regulators; the US mixes federal guidance, sector regulation and state laws; the UAE and Saudi Arabia have national AI strategies and ethics principles; and Pakistan has national AI policy work. Follow your organisation's legal and compliance guidance.

7:09 Recap and try this now

Let's recap. AI in financial work needs explicit controls because it adds confident, non-reproducible errors to decisions that matter. Use a seven-part framework: policy, risk tiering, human review, audit trail, validation, confidentiality and monitoring. Tier by how the output will be used, and for high-tier documents, reconcile every figure to the locked model. Apply model risk management disciplines to AI tools too. The common mistakes: no distinction between low and high-risk uses, reviewers who check wording but not numbers, feeding unlocked model versions to AI tools, and no record of AI involvement in decision documents. Start small: a one-page policy, a short list of approved tools, a three-tier rule and a simple log reviewed each quarter. Your try-this-now: write that one-page AI policy for a project finance team, with risk tiers, required checks and audit trail fields.