Evidence-gate card
HarbourBank vendor review
Fictional company, real review pattern.
HarbourBank, a fictional regulated bank, reviews AI-enabled vendors before it onboards them. The AI-governance evidence arrives in a different shape from every vendor, and the review team cannot compare like with like.
The team reads each submission on its own terms, in its own format. Comparing two vendors means re-reading both from the start, and a review takes weeks per vendor.
Custara prepared a common schema for each vendor submission, so the review team saw the same categories, the same status map and the same missing-evidence view before review started.
GER-00X · FICTIONAL
Scope: vendor review · Evidence period: current cycle
Record map in one consistent schema
Vendor A
- Model change control, status: present
- Human oversight settings, status: present
- Incident history, status: needs source
- Third-party model terms, status: present
Vendor B
- Model change control, status: needs source
- Human oversight settings, status: present
- Incident history, status: present
- Third-party model terms, status: missing
No score, no rank and no ordering. Structuring only.
documented at the time
Featured note: the two submissions now sit in the same categories with the same present, needs source or missing map. There is no score, no rank and no ordering of the vendors. Structuring only.
Fictional record. Status reflects record completeness, not governance judgement. Not a score, an assessment or a certification.
One vendor still needs source on incident history, and another is missing third-party model terms. The comparison keeps both visible without scoring either vendor.
Shown, not hidden. No score state.
A structured review pack that lets HarbourBank compare the submissions side by side in one schema.
The same schema can be reused across the vendor book and for the next onboarding review.
Custara put the submissions in one shape so they could be compared. HarbourBank's reviewers decided what to accept.
Custara put the submissions in one shape so they could be compared. It did not score them, rank them, or decide which vendor to accept. That stayed with HarbourBank.
Custara prepares the evidence record. It does not assess, score, classify, certify, rate, advise or recommend.