If you can't document what your tech does, you don't have a control

Eloise Butterworth · 5 October 2026 · a four-minute read

I've lost count of the audits where someone confidently tells me what their tech product does or doesn't do, and I know they're wrong. They aren't being dishonest. Nobody ever wrote it down.

My view: if you can't evidence what a product does against your risks, you don't have a control. You have a hope.

1. Your tech is a control, so treat it like one

In the firms I audit, most use at least one tech product and many use several: ID verification, screening, source of funds. They're all there to reduce the risks your firm faces and to drive efficiency.

Those risks should already be in your firm-wide risk assessment, with real data behind customer, geographic, service, transaction and delivery channel risk. So where does it say what each product does about each risk? In too many firms, nowhere.

2. Vendor reliance: are we being too trusting?

Not all tech vendors are equal. And too often, firms tell me that the vendor told them it was OK. That isn't their call. You cannot outsource your legal and regulatory obligations to your vendors. It's on you to know and understand what your tech does, and its limitations. A good tech vendor will make that clear to you.

3. What a good RegTech risk assessment looks like

One per product. It doesn't need to be fancy, but it does need to be real:

• Purpose, governance and ownership: why you use it, how you use it and who is accountable.
• Link to your firm-wide assessment: which risks it's meant to mitigate. It should be part of your controls, not your only control.
• Your own risk methodology and scoring: the same 3x3 or 5x5 matrix you use everywhere else.
• Suitability and effectiveness: does it actually address the risks your firm-wide risk assessment identifies? And where it doesn't, what other controls do you have or need to build?
• The awkward details: data sources, how often they refresh, non-Latin scripts, fuzzy matching and false positives.
• Escalation: who receives an alert, and who decides what happens next.
• Auditability: what sits where, and can you prove why decisions were made?
• AI and security: anything AI-driven must fit your own AI policy and cyber requirements.
• Training: who uses it, what they need to know, and who checks it's still working.

4. Go beyond the minimum

Look at integration with your practice, case and document management systems. Look at emerging risks too: impersonation fraud, synthetic identities, and misuse of the platform itself. The SRA's August 2026 sectoral risk assessment update puts more weight on technology and AI misuse, so your documents should keep pace.

5. "It’s too much work"

The legwork is real, and I won't pretend otherwise. It isn't one-and-done either, and that's the point: it repays the effort many times over.

Things keep moving: national and sectoral risk assessments, the sanctions list, and the high-risk country definitions, which were redefined from 30 June 2026. A living assessment lets you see what changed and whether your tech kept up. It also shows where your tech stack has holes, and it makes horizon scanning far easier.

6. Start this week

Pick the product you rely on most. Write down what you believe it does. Then check it against what it actually does. If there's a gap, better you find it than a regulator.

This is exactly what I do with firms at All Things Risk, but do the first one yourself. You'll learn more than any pitch will tell you.