Why Trusted Evidence Requires a Control Plane

1 Like

Why Many Organisations Still Struggle With Risk Data Governance

GeorgeBeevers_0-1783413827826.png

When BCBS239 was introduced following the financial crisis, the objective appeared straightforward: improve risk data aggregation, improve risk reporting, improve governance, improve traceability and improve accountability.

More than a decade later, many institutions still face significant challenges in demonstrating end-to-end compliance. The reason is not a lack of tooling. Many organisations have invested heavily in data governance platforms, metadata repositories, data catalogues, lineage products, data quality tooling and master data management solutions.

Yet fundamental questions remain difficult to answer:

Where did this number originate?
Which transformations produced it?
Which code generated it?
Which reports consume it?
Which controls validated it?
What would break if it changed?
The challenge is not information.
The challenge is understanding.

BCBS239 Was Never Really a Data Problem

Most programmes approached BCBS239 as a data management initiative.

In reality, it is a knowledge problem.

To satisfy BCBS239, an organisation must demonstrate understanding across multiple dimensions simultaneously:

Data
Processes
Transformations
Controls
Reporting
Ownership
Risk

Most tooling describes fragments of those dimensions.

Very few systems connect them.

As a result, organisations often possess extensive metadata, lineage repositories and governance documentation while still lacking true operational understanding of their risk estate.

The result is a dangerous gap between what organisations believe they know and what they can actually prove.

Understanding Versus Recording

There is an important distinction between recording information and understanding behaviour. A lineage platform might show a flow from Table A to Table B to Risk Report C. That is useful. But BCBS239 implicitly requires a deeper level of understanding.

Why was Table B created?
Which business rule was applied?
Which execution path was used?
Which controls validated the result?
Has this path actually executed in production?

Those are not metadata questions. They are reasoning questions. Many organisations have become exceptionally good at documenting estates they do not fully understand.

The Runtime Gap

One recurring issue in governance programmes is the gap between design-time understanding and runtime reality.

Most organisations can explain what systems are intended to do.

Far fewer can demonstrate what actually happens.

Production environments frequently contain:

Dynamic code generation
Generated SQL
Hidden dependencies
Scheduler frameworks
Runtime parameters
Legacy transformations
Operational workarounds
Decades of accumulated technical debt

Documentation describes intended behaviour. BCBS239 requires evidence of actual behaviour. The difference is significant. A transformation documented in a design repository is not proof that it executes. A lineage diagram is not proof that the path is used. A data catalogue entry is not proof that the control operates. BCBS239 is fundamentally an evidence-based discipline.

Why AI Alone Is Not the Answer

This is where current enthusiasm around AI becomes particularly interesting. Many organisations are beginning to ask whether AI can help solve governance challenges. The answer is both yes and no.

AI can certainly improve productivity.
It can explain documentation.
It can summarise metadata.
It can help users navigate complex estates.
What it cannot do is determine truth from incomplete information.

An AI model may produce a highly convincing explanation of how a risk number was calculated. The problem is that BCBS239 is not interested in plausible explanations. BCBS239 requires evidence. These are fundamentally different things. An explanation can be compelling yet incorrect. A regulator does not want the most likely answer. A regulator wants the demonstrably correct answer.

Why AI Without a Control Plane Is Dangerous

The temptation is to view AI as a universal knowledge engine capable of answering any enterprise question.

In practice, AI only knows what it can observe.

If the underlying organisation contains:

Incomplete metadata
Missing lineage
Unknown dependencies
Outdated documentation
Hidden runtime logic
Poor operational visibility

Then AI simply inherits those weaknesses. The result can be confident answers without trusted evidence. In governance scenarios this is arguably worse than uncertainty. A human admitting they do not know is manageable. An AI confidently presenting an incorrect answer creates a governance risk. BCBS239 is fundamentally an exercise in proving truth. Not generating convincing narratives.

Enter the Control Plane

This is where the concept of a Control Plane becomes important. A Control Plane does not replace governance tooling. It sits above it.

Rather than acting as another repository, it provides a unified layer of understanding across the organisation.

It combines:

Execution Truth
Dependency Truth
Transformation Truth
Business Context
Operational Context
Historical Context

A mature Control Plane brings together multiple perspectives.

Structural understanding answers:

What could happen?

Runtime understanding answers:

What actually happened?

Semantic understanding answers:

Why does it matter?

When fused together they create something much more powerful:

Verified Truth.

This is precisely the capability that many BCBS239 programmes have been missing.

BCBS239 as a Reasoning Problem

Viewed through this lens, BCBS239 becomes less of a governance tooling challenge and more of an organisational reasoning challenge.

The question is not:

Can I store lineage?

The question is:

Can I prove how a result was produced?
Can I explain that consistently across the organisation?
Can I demonstrate it with evidence?
Can I do so repeatedly under regulatory scrutiny?

Achieving that requires far more than metadata repositories.

It requires:

Runtime evidence
Dependency understanding
Business context
Semantic interpretation
Historical memory
Operational visibility

In effect, organisations need a mechanism that understands both technical implementation and business meaning simultaneously.

From Governance to Decision Intelligence

There is a broader implication.

The same capabilities required to satisfy BCBS239 are the capabilities required for successful transformation programmes.

They support:

Modernisation
Cloud migration
Operational resilience
Cost optimisation
Technical debt reduction
AI adoption

This is because all of these initiatives rely upon the same foundation:

Trusted organisational context.

A Control Plane turns governance from a compliance exercise into a strategic capability. It enables organisations to make better decisions because they understand their estates more completely.

The Future Architecture

The next generation of enterprise architecture is likely to consist of three layers.

The first layer contains systems of record that execute business processes and store operational data.
The second layer is the Control Plane that provides trusted organisational understanding.
The third layer consists of AI agents and automation systems that consume this understanding.

In this model, AI is not responsible for discovering truth. The Control Plane is. AI becomes a consumer of evidence rather than a creator of evidence. That distinction is critical. Especially in regulated environments where the goal is not to generate answers but to demonstrate why those answers are correct.

Conclusion

More than a decade after its introduction, BCBS239 remains challenging for many institutions not because they lack data governance tools, but because they lack a mechanism for understanding how their organisations truly operate. The industry has spent years collecting metadata. The next challenge is creating understanding. AI will undoubtedly become an important part of the future enterprise landscape.

However, AI should not be expected to establish truth from incomplete information. Without trusted context, AI merely accelerates uncertainty. A Control Plane provides the missing layer between systems and intelligence. It combines structural knowledge, runtime evidence and business meaning to create a trusted foundation for both governance and decision making.

Ultimately, BCBS239 has never really been a data governance challenge. It has always been a challenge of organisational understanding. AI may help explain an estate. Only a Control Plane can provide the evidence needed to trust the explanation.