Rivermark Bank: Buy vs. Build the Governance Plane on an Existing OpenPages Footprint
Rivermark Bank governs 340 models. Roughly 210 regulatory and credit models sit in IBM OpenPages under operational risk, 90 marketing propensity models live in spreadsheets owned by channel teams, and 40 generative AI pilots are tracked in a shared inbox. A recent supervisory review criticised inconsistent inventory and missing validation evidence for the marketing models. Rivermark operates in the US and the EU, has 9 FTE in model risk management, and no dedicated AI governance staff. The buying committee is split: the CRO is accountable and wants defensible evidence; the CIO proposes a 14-week internal build on the existing OpenPages instance plus a ticketing tool, arguing that the bank already owns its GRC platform; the CDO cares about lineage; the head of marketing wants gen AI shipped faster. The CIO estimates the build at 6 FTE for 12 months plus USD 1.1M of integration. Procurement requires a documented value case before next quarter, and the CRO has asked you to facilitate the decision rather than simply sell a licence.
1. The CIO argues the bank should build on its existing OpenPages instance rather than license watsonx.governance. How do you reframe the decision, and what do you recommend?
Read the worked answer
Reframe from 'buy vs. build' to 'which layer is commodity and which is differentiating', and correct the factual premise before arguing.
OpenPages is not the alternative to watsonx.governance; it is a component of it. The model risk management capability in watsonx.governance runs on OpenPages, so the bank's risk registers, control hierarchies and issue workflows can be reused rather than replaced. Before saying this in the room, verify which edition and entitlements Rivermark actually owns, and whether the model risk management content is included. If it is not, the 'build' is really a licence upgrade plus configuration, and the comparison changes.
Price the recurring cost, not just year one. The 6 FTE x 12 months plus USD 1.1M covers build only. It omits regulatory content maintenance (EU AI Act and NIST AI RMF mappings), connector upkeep for every model source, factsheet schema evolution, and gen AI evaluation metrics that change quarterly. A three-year total cost of ownership with an explicit maintenance line is the honest comparison.
Score both options on the metric the regulator actually cited: time to produce complete, current evidence for the 90 spreadsheet models.
Recommendation: license the governance plane, retain OpenPages as the substrate, and phase in inventory plus factsheets first. State openly that if scope were one cloud, one model type and no gen AI, an internal build could be defensible. That concession buys credibility for the rest.
2. Which objections are most likely to stall the decision, and how do you answer each without overpromising?
Read the worked answer
Objection 1 - CIO: 'this adds a vendor and removes my team's control.' Do not argue ideology. Answer with control mechanics: the platform is configurable to Rivermark's own risk taxonomy and approval workflow, integrates through APIs and SSO, and can be deployed in a way that fits the bank's change control. Offer a joint design authority with named CIO architects so the build skills move into configuration and integration rather than disappearing. Avoid claiming 'no customisation needed' - that will be tested in week three.
Objection 2 - CRO: 'will this actually close the supervisory finding?' No tool closes a finding. Answer with the evidence chain: every model gets a factsheet with owner, purpose, data, validation status and last review; validation tasks and sign-offs are recorded with timestamps; drift and fairness results attach to the same record; an examiner can be shown a complete trail rather than reconstructed emails. Commit to demonstrating that trail for five real models in a proof of value, and be explicit that process discipline is still required.
Objection 3 - Head of marketing: 'governance slows us down.' Reframe it: the current spreadsheet-and-inbox process is why the 40 pilots have no clear approval path. Pre-approved patterns and a defined intake reduce time-to-approval. Do not promise a specific speed-up number you cannot baseline - measure current approval cycle time in the proof of value and use that as the baseline.
Procurement: present the three-year total cost of ownership, redeployed FTE and audit effort, and refuse to present avoided fines as a hard benefit.
3. The value case must contain numbers. Which value levers would you quantify, which would you only describe qualitatively, and why?
Read the worked answer
Quantify (measurable from Rivermark's own data within four weeks):
- Validation effort per model: hours spent assembling evidence for the 210 OpenPages models and the 90 spreadsheet models, times the expected reduction in rework, based on a time-and-motion sample rather than an assumption.
- Time-to-approval for new AI use cases: baseline median cycle time for the 40 pilots, tracked before and after intake is standardised.
- Inventory completeness cost: effort currently spent reconciling spreadsheets and inboxes each quarter.
- Duplicated tooling: any overlapping spend on separate monitoring or documentation tools in the six AI vendor contracts, which can be retired.
- Redeployed FTE: the 6 FTE the CIO would have committed to build and then maintain.
Describe qualitatively, with no number attached:
- Regulatory exposure. Avoided fines are contingent and cannot be booked as a benefit. Present the supervisory finding, the EU exposure and the evidence gap as risk context, sized as exposure ranges rather than savings.
- Reputational and customer harm from a bad gen AI output.
Why the split matters: a value case that leans on avoided penalties loses credibility with a CFO who has watched vendors inflate regulatory risk. A case built on cycle time, effort and retired tooling survives challenge because each line can be traced to a Rivermark source system. Present the qualitative items on a separate page labelled as risk, not return.