Practical writing on technology governance, risk appetite, AI risk and controls for financial services — from someone who has sat on the institutional side of these questions. No thought leadership, no predictions. What the requirements actually are and what a proportionate response looks like.
A spreadsheet arrives with two hundred questions and a fourteen-day deadline, and someone tells you it’s a formality. It isn’t — but it also isn’t the test most vendors think it is. What actually happens to your answers after you hit send.
Read the article: what a bank actually looks for when it sends you a technology due diligence questionnaireAlso on the site
OSFI’s revised Guideline E-23 takes effect in May 2027, and it makes institutions accountable for models they didn’t build. The evidentiary burden lands on the vendors who did.
Read the article: your client’s model risk rules are about to become your problem, E-23 for vendorsMost small-firm risk appetite statements have never stopped anyone doing anything. What makes one operable — position, boundary, consequence — with a worked one-page example.
Read the article: risk appetite statements for organizations too small to have a risk functionMost AI policies fail because the document gets written before the decisions get made. Six genuine forks, and what usually works at small scale.
Read the article: AI usage policy, the six decisions a small firm has to make firstAudit committees are asking for AI coverage and few internal audit functions know what the audit contains. Scope, the four layers you test, and how to write findings people act on.
Read the article: what an AI audit actually looks likeFree resources
Twenty-six self-assessment items across six governance domains — the questions a regulated institution’s reviewer is trying to answer about your models, turned into a checklist you can complete in under an hour. Free, and yours to circulate internally.
A five-page working document, not a checklist: the three-part structure that makes a position operable, a worked example, four blank risk areas, and guidance on setting boundaries when you have no history. Run the session, and you finish holding a real statement.
Most engagements start with a question someone else has already asked you — a questionnaire, an audit finding, a board request. Thirty minutes, no cost, and you’ll leave with a straight view of what answering it takes.
Book a 30-minute consultationOr email hello@hosmaksolutions.ca
