Operational brief: forensic BPMN in a Swiss private bank

Situation

A Swiss private bank engaged TSG on an internal-controls modernization programme. The written procedures existed but were partially outdated. The real operating knowledge lived in the heads of a small number of senior operators. Any AI initiative built on top of the documented process would automate a version of the work that had not existed in practice for years - and would inherit its blind spots.

• Regulated environment with strong controls expectations.
• Written SOPs partially disconnected from actual execution.
• Key operational knowledge concentrated in a few senior people.

Friction

The core friction was not technical. It was that no one could show, on paper, how each process actually ran end-to-end - with its exceptions, its escalation paths, and the controls that were being enforced in practice versus those that were only documented. Without that ground truth, no AI use case could be defensibly scoped and no risk owner would sign off on deployment.

• Gap between as-documented and as-run process.
• No single source-of-truth for controls actually enforced.
• Second-line functions unable to challenge deployments without that source of truth.

Intervention

TSG reconstructed the target processes from the documented sources - policies, procedures, control catalogs - rather than from interviews. Each activity, gateway and control was linked back to the source that justified it. A double human-in-the-loop review was applied: TSG validated internal consistency; the bank validated business truth. Only once this sourced ground truth existed were AI agents scoped on top of specific process segments.

• Process reconstruction from sources, not anecdotes.
• Each element traceable to a policy or a control.
• Double HITL: TSG-side technical review, bank-side business validation.
• Agent scoping only after ground truth was accepted.

Operating model

The resulting operating model has clear boundaries. Every BPMN version is immutable once approved. Any change requires a new version with its own approval trail. Agents may act only on segments explicitly whitelisted, with hard-enforced boundaries at runtime. Second-line functions have a direct read on the whole audit trail. Retirement of a component is as designed-in as its deployment.

Evidence

The evidence we track is not model accuracy. It is whether the second-line function can sign off on a deployment without a special exception, and whether new joiners can be onboarded on the sourced process rather than on tribal knowledge. Both of these were previously not achievable. Both now are. Quantified client outcomes are intentionally not disclosed in this brief.