4 policies
- AI acceptable use
- Model and agent standard
- GenAI data handling
- Third party AI
Worked example / Fictitious company
Corvane Financial.
The full journey.
One firm taken through every part of the offer, from the first inventory to live monitoring. Corvane Financial is invented, and so are all of its numbers and findings.
Fictitious exampleThe client
Corvane Financial
A fictitious diversified financial services group
- Lines of business
- Retail banking, wealth, insurance
- Employees
- 18,000
- Markets
- UK, EU and US
- Models in use
- Gemini, Claude, GPT and two open weight models
Why they called
A mortgage assistant quoted a rate that did not exist. The board asked three questions nobody could answer: which AI do we run, how does it behave under attack, and who owns the risk?
Stage 01 / 04 / Weeks 1 to 2
Assess
- 96AI systems found
- 31Missing from any register
- 9Tier 1 (highest risk)
- 42%Business owners named
Maturity, current against target
- Inventory1.5 / 5
- Model behaviour2.5 / 5
- Data and privacy3 / 5
- Security and misuse1.5 / 5
- Accountability2 / 5
Current Target
Top findings
- HighComplaints agent can be steered by instructions hidden in customer emails.
- HighMortgage assistant invents product terms when rates change mid conversation.
- HighAdvisor copilot gives less complete answers for some customer segments.
- MediumA third of GenAI tools sit outside the model risk inventory.
- MediumNo owner for risk in models bought from vendors.
Claude Fable rapid eval on five priority systems
| System | Model | Tests | Pass rate | High severity |
|---|---|---|---|---|
| Mortgage assistant | GPT | 2,400 | 91.2% | 4 |
| Claims summariser | Claude | 1,800 | 96.8% | 1 |
| Advisor copilot (wealth) | Gemini | 2,100 | 93.5% | 3 |
| Complaints triage agent | Claude | 1,500 | 89.4% | 5 |
| KYC document reader | Open weight | 1,200 | 94.1% | 2 |
9,000 tests generated from Corvane Financial policies. Every high severity finding verified by Faculty.
Stage 02 / 04 / Weeks 3 to 6
Design
Every finding becomes an owned action
31 unregistered systemsMandatory AI intake with automatic risk tieringChief Data Office
Prompt injection in complaints agentRed team sign off gate for tier 1 and 2 releasesCISO
Uneven answers across segmentsFairness thresholds and monitoring per use caseModel risk
Invented product termsGrounding to the product catalogue and a factuality test setMortgages product owner
Vendor model risk unownedDue diligence and contract clauses for AI suppliersProcurement
The RAI council
- Chair
- Chief Risk Officer
- Members
- CDO, CISO, General Counsel, Head of Model Risk, business line heads
- Cadence
- Monthly, with tier 1 decisions escalated within five days
- Independent challenge
- Internal audit, supported by Faculty
Stage 03 / 04 / Months 2 to 5
Implement
PRC, Policy, Risk and Controls, built and live
57 risks registered
- Taxonomy of 12 AI risk types
- Tiering tied to the inventory
- Eight key risk indicators
112 controls
- Mapped once to EU AI Act, ISO/IEC 42001 and NIST AI RMF
- 64% tested automatically
- Evidence stored per release
Security by design
- 61%Agent tool permissions removed
- 9 of 9 tier 1Systems behind injection filters
- 22Vendors through AI due diligence
Stage 04 / 04 / Month 2 onward
Assure
Red team / Complaints triage agent, before relaunch
Six ways in. All six closed.
- 5,600Attack attempts
- 14Expert campaigns
- 6Exploit paths found
- 6 of 6Closed before relaunch
Exploit paths by attack type
- Prompt injection in email3
- Data leakage1
- Agent tool misuse2
- Jailbreaks0
- Harmful output0
Open high severity findings, all systems
- Live evaluations
- Daily on all tier 1 systems
- Regression suite
- Every release, 3,200 attacks
- Drift alerts caught
- 7 in six months
- Board assurance
- Quarterly report, annual independent review
Six months later
From unanswerable to evidenced.
BeforeAfter
AI systems registered65 of 9696 of 96
Tier 1 systems red teamed09
Open high severity findings152
Named risk owners42%100%
Time to approve a low risk use case6 weeks3 days
Corvane Financial is fictitious. All figures illustrate what an engagement reports; none are measured results.
Start where Corvane Financial started.
A two week Claude Fable rapid eval on your highest risk systems.