Two weeks before an examination, every compliance team discovers the same truth: having the right policies is not the same as showing that staff use them. Examiners can read a policy in minutes. What takes longer is proving that the people answering customers, pricing loans and handling disputes worked from the current version. And somewhere, there is always a whiteboard counting down the days in increasingly worried handwriting.
Read the story behind this: The Laminated Policy Part 4
The problem
Banks hold large libraries of approved policy: fee schedules, product terms, credit manuals, operating procedures and technology policies. Each is reviewed, approved and published. But the path from an approved document to what a staff member actually says or does is often invisible.
Training records show that staff were taught. They do not show what staff consulted on a busy Tuesday. Unofficial shortcuts, such as cheat sheets, screenshots and personal spreadsheets, fill that gap and leave no trace.
Why it happens
- Policy use is rarely recorded. Staff read documents, but reading leaves no record.
- Shortcuts are invisible. Paper sheets and personal files sit outside every system the compliance team can see.
- Evidence is scattered. Training logs, access records and policy versions live in different places.
- Customer data complicates sharing. Evidence that includes customer details cannot simply be handed to reviewers.
- Technology expectations are rising. The central bank's Risk Management in Technology (RMiT) policy document, issued on 25 September 2026, requires financial institutions to ensure that "user activities in critical systems are logged for audit and investigations" (paragraph 10.57(c)). It also requires IT-related frameworks, policies and guidelines to be reviewed at least once every three years (paragraph 8.2(d)), and adequate and regular technology and cybersecurity awareness education for all staff (paragraph 15.1). Source: RMiT policy document
What good looks like
A bank that can show examiners how policy is used usually has:
- One approved body of policy content, with withdrawn versions clearly retired.
- A governed way for staff to look up policy, so that use leaves a record.
- Audit trails showing who asked what, when, and which approved documents were cited.
- Redaction, so evidence can be shared without exposing customer details.
- Retention rules, so records still exist when reviewers ask for them.
- A habit of finding, fixing and disclosing gaps, rather than tidying them away.
How enterprise knowledge AI helps
An enterprise knowledge AI platform such as iKB, by Astiostech, turns approved organisational content into governed answers with citations. For compliance teams, the governance features matter as much as the answers:
- Audit trails, activity logging, event records and exports. These show how staff use approved content across branches, contact centres and credit teams, and can be exported for review.
- Redaction and retention rules. Part of iKB's AI governance features, these help keep customer details out of shared evidence and keep records available for the required period.
- Citations on every answer. Each logged answer links to the approved document it relied on, so reviewers can see which version staff were given.
- Role-based access control. Restricted material stays visible only to the roles permitted to see it.
Patterns in the records can also reveal problems. If staff in many departments keep asking about a rule that was withdrawn years ago, the questions themselves suggest an outdated source is still circulating somewhere.
Whether a platform's controls meet regulatory requirements, and whether it counts as a critical system, is for each bank to assess within its own technology risk framework. No single product makes a bank compliant.
What to check before buying
- Audit detail. Does the audit trail record who asked, when, what was asked and what was cited?
- Export quality. Can you export records in a form your compliance team and reviewers can actually read?
- Redaction. Test that customer details are removed before evidence is shared.
- Retention. Confirm retention rules can be set to match your own policies.
- Access control. Check that restricted content stays restricted by role.
- Fit with your framework. Involve technology risk early, so the platform is assessed under your own classification and controls.
Next steps
Pick one area that examiners commonly probe, such as fees and waivers or card disputes. Make sure the current approved content is connected, check what the audit trail records, run a redacted export and review it as an examiner would. Look for repeated questions about old rules: they point to shortcuts you have not found yet. Then go and find them. Bring a box.
To see how iKB's audit trails and governance features work in practice, book a briefing on governed knowledge AI for your organisation with the Astiostech team.