Why Controls Fragmentation, Not Technology Gaps, Is the Real Defensibility Problem

A Q&A with Caitlin Like, Global Head of Customer Success and Account Management, Behavox. Following her keynote presentation at CeFPro's Risk Evolve 2026 in London, Caitlin Like sat down to discuss why controls fragmentation remains the most persistent barrier to defensibility for financial institutions, and how AI-native platforms are changing the equation.

The term "controls fragmentation" came up throughout your session at Risk Evolve. What does that mean in practice for a compliance or risk leader at a major bank?

In most large financial institutions, the controls that govern conduct and market integrity have been built incrementally — by product, by region, by risk type. Communications surveillance sits in one system. Trade surveillance sits in another. Policies and procedures live in a document repository or GRC platform that has no real-time connection to either. Case management is a fourth system. When an examiner asks for evidence that a control worked — or asks your team to reconstruct a conduct timeline — someone has to manually stitch together records from all of these systems. That manual reconstruction is expensive, slow, and error-prone. But the deeper problem is this: the same conduct or market abuse risk has to be defined multiple times across those systems, and the definitions often diverge. The result is a controls programme that performs inconsistently and cannot produce reproducible evidence at scale. That is what fragmentation looks like from the inside — and it's why firms with significant technology investment still fail to demonstrate defensibility when it matters.

You talked about "defensibility-grade" integration as the standard to aim for. What distinguishes a defensibility-grade programme from one that merely has multiple surveillance tools in place?

The test is simple: can you trace a regulatory obligation through your control design, through your monitoring, through your case outcomes, and through your remediation — with reproducible evidence at every step? Most firms can demonstrate that they have surveillance tools. Fewer can demonstrate that those tools are enforcing specific policies, that those policies map to specific regulatory obligations, and that when something goes wrong, the system produces an auditable record of what was detected, what was investigated, and what was done about it. Defensibility-grade integration means the evidence chain is intact before the examiner asks for it — not reconstructed after the fact by analysts pulling records from disparate systems. The distinction between "we have surveillance" and "our surveillance is defensible" is exactly where firms are being challenged today.

AI was a dominant theme across the Risk Evolve agenda this year. How does Behavox think about AI specifically in the context of controls — and how do you address the model validation challenge?

The controls context is unforgiving for AI. Unlike a recommendation engine or a pricing model, an AI system operating in surveillance is subject to regulatory scrutiny, must produce explainable outputs, and must pass model validation under frameworks like SR 11-7. The failure mode of generic AI in this context is well-documented: models that cannot be validated, that produce unexplainable alerts, and that generate high false-positive volumes because they have not been tuned for specific control problems. Behavox's approach is purpose-built AI for specific controls use cases — our own family of LLMs trained for communications surveillance, trade surveillance, and policy management. These models have been in production for over three years and have passed dozens of model validation reviews. The documentation that makes outputs explainable, transparent, and governable is built in — not retrofitted. When compliance leaders ask us what happens when an AI model is challenged in an examination, we can point to a production track record rather than a promise.