A lot of risk teams carry an assumption they have never quite tested: rules are safe because a person wrote them, and models are risky because nobody did. Deterministic if this, then that feels auditable. A score coming out of a model feels like a black box. So the plan becomes “keep the rules, resist the AI”, as if the architecture were the control.
It isn’t. We have sat in enough of these reviews to say what an auditor actually asks, and it has nothing to do with whether the logic underneath is a rule, a scorecard or a model.
What the question actually is
Three things, every time. Can you give me the specific reason this one customer was declined, in language they would understand? What policy version was in effect when that decision was made, and can you show me it hasn’t quietly drifted since? And can you show this decision was applied the same way to everyone in the same position, not just this one case you happened to pull?
A rules engine can fail every one of those. A business rule gets tweaked in March, nobody versions it, and by November nobody can say what the rule was when the disputed decision happened. That is not a hypothetical: it is the most common finding in the reviews we run. Deterministic logic is not the same thing as governed logic. It is just logic that is easier to read, which is not nothing, but it is not the answer to the auditor’s question either.
A model, built with the same discipline, passes all three. The reasons for a decision get captured at the moment it is made, not reconstructed afterwards. The policy and model version travel with every decision. Consistency is measurable rather than assumed.
What actually earns the auditor’s confidence
Our view is it comes down to four things, and they apply whether the decision came from a rule, a score or a model. Every decision is logged with its inputs and its reasons, at the time it happens. Policy changes are versioned, so you can answer “what was true then” as easily as “what is true now”. Explanations exist in plain language, not just in a variable name. And people are kept in the loop on the decisions that need judgement, by design, not as an afterthought.
Build those four in, and the label on the box stops mattering. Leave them out, and a spreadsheet of if-statements is exactly as indefensible as a model nobody can explain.
That is the distinction we designed CxOS around: not rules versus AI, but governed versus ungoverned. The same discipline we described for CPS 230 applies here regardless of what is doing the deciding.