1. The risk assessment
System | The consequence | Who bears it | Probability | Severity | Band | Mitigation, and its level |
|---|---|---|---|---|---|---|
Pulse | A weekly score of how likely a named person is to leave is shown to their line manager, built in part from a sentiment indicator read off meeting and email subject lines. Nobody scored has been told | 4,027 employees across nine entities. Those in teams of eight or more carry more of it, for no reason anybody chose | High. The score refreshes weekly and nothing sits between it and the manager | High. It reaches pay, progression and who gets the work, and cannot be contested by somebody who does not know it exists | Critical | Turn off module 7. Report the team forecast, not the individual score. Levels 1 and 2 |
Proctor360 | A session is flagged by an indicator of attention and composure, and the path from a flag ends at a void assessment and a malpractice report to the awarding organisation | 186 apprentices in the current cohort, 31 of them under 18 at registration. All are Meridian's own people | High for being reviewed, which the indicator guarantees for the outer decile. Low for the Panel: 8 sessions in 412 | Low for the 96 closed with no concern. High for the 2 whose assessment was voided | Moderate for review, high for referral. Two rows, not an average | Remove flag F8. Level 1 |
The risk assessment, continued
System | The consequence | Who bears it | Probability | Severity | Band | Mitigation, and its level |
|---|---|---|---|---|---|---|
Arbiter | An applicant declined without a person seeing the application asks for the decision to be looked at again, and the request is recorded nowhere | 33,483 applicants declined without reaching a person in one quarter, 129,254 in a year | High. The decline is routine. It is the review that is rare | Moderate to high: refused credit, with a reason from a library of thirty two codes | High, on volume rather than the severity of any single case | Add a field recording a request for human review when it is made. Level 3 |
Pulse.
Nothing sits between the score and the manager acting on it, and the person scored has never been told, so probability is set by the refresh cycle rather than by how often the model is wrong.
Proctor360.
F8 flags the outer decile by construction, so about one session in ten is flagged whatever the learner did, and F8 and the gaze flag produced 71 per cent of all flags last year.
Arbiter.
The harm is not the decline, which is ordinary and lawful, but that requests for review are counted out of the complaints system, so nobody can say how many people asked.
The mitigations, and why the obvious one is not the answer
Pulse.
The first idea is to tell employees. That is an administrative control at the bottom of the hierarchy and it changes nothing about what the system does.
Two stronger levels were available and neither was chosen. Module 7, which derives a weekly sentiment indicator from calendar and email subject lines and feeds it into the flight risk model, is on because the supplier's default is on.
The specification records it as "default retained". Turning it off is elimination. Then substitution: The platform already produces a team stability forecast, so managers can have the team figure instead of the individual score.
Notification comes last, and by then it is smaller.
You can do none of this alone, which is why the question is who has to agree. The supplier summary records Pulse's contract owner as "not recorded", the invoice sits with Group Services, and two purchase orders were raised by two different people at £41,200 and £43,900, each below the £50,000 threshold that would have required a security assessment. The processing register extract returned no record for it at all.
The mitigations, continued
Proctor360.
The awarding organisation requires invigilation, evidence of it, and retention of the session record. None of that is what you are assessing.
F8 is: An indicator of attention and composure, at the supplier's standard sensitivity, flagging the outer decile, unpublished to learners, and required by nobody.
Removing it is elimination, it costs a configuration change, and everything the awarding organisation asks for survives.
One finding while you are there: Paragraph 5 says the platform decides nothing, which is true about outcomes, but sessions with no flags are not reviewed, so the platform decides who gets looked at.
Arbiter.
The first idea is to train the underwriters or write an oversight procedure. Level four. What is missing is a field. The lending platform has none for a request for human review, so the figures come out of the complaints system, and a customer who telephones and is told the decision stands is counted nowhere.
Until that field exists nobody can size the population, which means nobody can tell a well calibrated model from a review that cannot change anything. Sixteen changes on 33,483 automated declines is 0.05 per cent, and eleven of the sixteen came from one underwriter who works that queue on Mondays and Thursdays.
Do not write that the oversight is cosmetic. Write that the figures cannot separate the two readings, and name the test that can: Whether an override has ever moved a threshold, a policy rule or a reason code.
One row per risk
Beside Pulse's individual score sits a second risk of a different kind. The Frankfurt works agreement of November 2024 requires prior written notification and the works council's agreement before any system capable of monitoring conduct or performance is introduced, and bars individual performance rankings.
Pulse went live eight months later, is not in Annex 1, and the checklist item asking the customer to confirm that works council consultation was complete was marked confirmed on 18 July 2025.
Different bearer, different kind of harm, same system. Write both rows rather than one averaged one.
2. The acceptance question
Pulse: The Group Human Resources Director, and she refuses
She is the right person to ask: Named as implementation lead, she requested the purchase and signed the confirmation at checklist item 14.
She is also right to refuse, and that is the finding. Pulse is configured for every employee of Meridian Group plc and its subsidiary undertakings, nine legal entities in several countries. She is not the employer of the people in Frankfurt or Dubai, and a residual risk falling on another entity's employees is not hers to accept for them.
What you do next. A model at 116 words.
Record the refusal as a finding, in her words, not as a failure to obtain a signature. Split the residual risk by employing entity, because that is what her refusal tells you the register needs. Take the Frankfurt row to Group Legal, who hold the works agreement on the Frankfurt file, and to the managing director of the German entity, who is the employer there. Take the group-wide row to Priya Raghunathan, ask her to put it to Marcus Whitfield, and ask for it on the Board Risk Committee agenda, because no standing committee owns a system deployed across every entity. Meanwhile ask for the two configuration changes. Neither of those needs anybody to accept anything.
The acceptance question, continued
Proctor360: The Head of Learning and Development
The Head of Learning and Development owns the procedure, approves the platform configuration, chairs the Assessment Integrity Panel and can switch F8 off. The Group Human Resources Director approved the procedure, which makes her the approver of a document rather than the owner of the risk.
This is the only one of the three with a named owner, a named approver and a review date on the face of its own document. The acceptance should name the cohort it covers, including that 31 were under 18 at registration.
Arbiter: The Head of Credit Risk
She is the contract owner, she countersigned the master agreement as business owner, and clause 4.2 puts the cut-offs, the decision communicated, the explanation given and validation against Meridian's own population on the customer rather than the supplier. She will accept in writing.
Write the acceptance so that it says what was accepted, on what volume, by whom and when it is reviewed. A risk accepted on 33,483 declines a quarter has not been accepted if the volume doubles and nobody looks again.
The mistake this section exists to catch is reading a refusal as obstruction and going to find a more senior signature instead. That refusal named a defect no document in the pack names.
3. The vendor judgement
A model at 249 words.
What the file establishes. The counterparty is Corvid Data Services Limited, company number 07714903. The ledger and the model card both say Corvid Analytics; both names sit in our records. Meridian owns the decision: Clause 4.2 places the cut-offs, the decision communicated, the explanation given and validation against our population on us. The supplier holds a current ISO/IEC 27001 certificate, scoped to the design, development and maintenance of its analytics products at Reading. The scoring service runs from Dublin, with a secondary environment in Frankfurt and second line support from Porto. The scope reaches none of them.
What it does not establish. That the model works on our book. The model card measures a development population of 214,600 applications and tells clients on a different population to validate against their own. Our vendor review cell is blank, which the notes say means none has been completed. The model card on file is version 4.2, dated January 2024, and we bought a retrain in April 2026. Clause 8.4 says retraining, recalibration and changes to attribute weighting are not changes requiring notice, so the document describing the model need not describe the model. The audit right at clause 15 covers charges and service levels and expressly excludes weights, attribute derivations, validation data and development records.
Before the next renewal. There is not one. Notice was due by 13 March 2026 and the agreement now runs to 2030, so anything we want is a variation. Ask at the next statement of work.
The vendor judgement, continued
What makes this work. It separates the contract from the marketing, finds the date before making a recommendation, and does not call the supplier evasive. The reply of 9 September 2026 about ISO/IEC 42001 was honest and answered a different question: A certificate for an information security management system says how a company is run, and nothing about a model.
What most answers miss is the fourth party. The "model provider" column on our own supplier record was added in September 2026 and never filled in, and clauses 3.3 and 3.4 let the supplier substitute third party materials without telling us. The file cannot say whose model this is.
4. The note
A model at 235 words. It is written after the acceptance conversation, not before.
I have been through what we hold on Pulse and Proctor360: the configuration specification, the invigilation procedure, the purchase records and our processing register. I am inside Pulse's scope myself, so I have kept to configuration and aggregate figures and have not asked to see anybody's scores.
You are right that we cannot stop invigilating. The awarding organisation requires it, and the recording and the retention come with it. I am not asking for any of that.
I am asking about one flag. F8 returns an indicator of attention and composure from head position, facial movement, blink rate and voice, at the supplier's default sensitivity, and it flags the outer decile whatever the learner did. It and the gaze flag produced 71 per cent of all flags last year. Nobody requires it, and learners are not told it exists. Switching it off is a configuration change, and nothing the awarding organisation asks for is lost.
On Pulse, you were right that the acceptance is not yours. It covers employees of nine legal entities and you are not their employer. I am writing that up as a finding and taking it to Priya and Marcus rather than back to you.
Two things you could decide this month: turn module 7 off, and give line managers the team forecast rather than individual scores.
Could I have thirty minutes with you and the Head of Learning and Development?
What this note does.
It names the constraint it accepts before asking for anything. It declares the writer's own position inside Pulse's scope, which is why the request stays at the level of configuration.
It asks about one flag rather than a platform. It carries her refusal forward as correct instead of arguing with it. It ends with two decisions she can take alone, and half an hour.
What a weaker note does.
It uses the word surveillance. It asks for a sample of individual scores or session recordings as evidence, which means looking at colleagues' records with no reason of your own.
Or it asks her, more firmly, to accept the Pulse risk.
5. The rubric
Score yourself on each criterion. Be strict.
Criterion one: The risk assessment
Score | Description |
|---|---|
Yes | Consequences are written as things that happen to named groups of people. Probability is the probability of the harm reaching somebody, not of the model being wrong. At least two mitigations sit above level four and each names who has to agree. Module 7 and F8, the two settings nobody chose, are both found |
Nearly | The bands are defensible, but every mitigation is training, a policy or a notification, so the assessment sits entirely at levels four and five |
Not yet | Risk is described as a property of a system rather than something that happens to somebody, or the systems are banded with nobody named as bearing anything |
Criterion two: Acceptance and the vendor
Score | Description |
|---|---|
Yes | The refusal is identified, and identified as correct. What follows names people, a document and a committee. The vendor answer finds the renewal date, separates the contract from the model card, and reads the certificate scope against where the service runs |
Nearly | The refusal is spotted but treated as an obstacle to route around. Or the vendor answer lists what is missing without noticing that the moment to ask has passed |
Not yet | The refusal is read as obstruction and a senior signature sought instead. Or the supplier's information security certificate is taken as evidence about the model |
Criterion three: Writing about systems used on your colleagues
Score | Description |
|---|---|
Yes | The note concedes what the Human Resources Director is right about before asking for anything. It asks about the flag and not the platform. The work states the writer's own position inside the scored population, and nowhere asks to see an identifiable colleague's score or session |
Nearly | The note is accurate and proportionate, but treats these as ordinary supplier systems, with nothing that recognises whose data this is |
Not yet | The note asks her to accept the Pulse risk again. Or the work asks for individual records as evidence. Or it goes to the works council, the employees or the apprentices directly |
Where this goes
Part Five starts with the law. You meet these three systems again, and you are asked something about them that the method you used here cannot answer. Keep these rows.
At least one band will look different by week eighteen, and the interesting part will be that your reasoning was not wrong.
Week 19 asks you to put all of it in front of a board.
Part Four assessment: Model answer and rubric
Read this against what you submitted. The point is not the score. The point is the gap.