The Inventory With a Ten Year Memory

The Examiner’s Question - RBI’s MRMF 2026, read like evidence. By Dr. Anandkumar Prakasam

The Clause

Four paragraphs, one register, one long memory. Paragraph 21 requires an inventory of every model, active, inactive and decommissioned, with a hard rule attached, nothing may be used unless it is inventoried. Paragraph 22 sets minimum fields, including something most institutions have never recorded, the dependencies running upstream and downstream of each model. Paragraph 23 is the sleeper clause of the whole draft. Decommissioned models stay in the inventory for at least ten years. Paragraph 24 extends the same discipline to documentation, retained in alignment with the inventory, for every model.

What It Actually Asks

The inventory clauses look clerical and are actually forensic. The nothing-used-unless-inventoried rule of paragraph 21 turns the register into a licence, which means gaps are violations rather than housekeeping lapses. Paragraph 22’s dependency fields quietly demand a map of influence, which data feeds which model, which model feeds which decision, and which downstream process inherits an upstream failure. Almost no institution can produce that map today, and every episode of vendor drift or silent data change makes its absence expensive. But the ten year rule is where the drafting turns prophetic. A record that must answer questions a decade after the model died is not a record in the ordinary sense. It must survive personnel turnover, platform migrations, vendor exits and at least two reorganisations, and it must still be believable at the end, which raises the question paragraph 23 never asks aloud. Believable to whom, against what standard of challenge. The honest answer is a court’s standard, because the only ten year old questions that matter arrive with lawyers attached.

The Incident File

Between 1999 and 2015 the UK Post Office prosecuted more than seven hundred subpostmasters for theft and false accounting on the strength of data from Horizon, its Fujitsu-built branch accounting system. The records said money was missing, and the records were treated as truth. People went to prison on them, lost homes and livelihoods, and in some cases their lives ended under the weight. It took until April 2021 for the Court of Appeal to quash the first thirty nine convictions in bulk, finding that Horizon’s data was unreliable and that the reliability question had been suppressed for years. Known defects were logged inside Fujitsu while prosecutions proceeded outside. Remote access that could alter branch records existed while the Post Office denied it. The system’s records outlived the careers of everyone who deployed it, and for two decades they answered every question except the ones that mattered. Who could change this record. Was it changed. How would we know. Paragraph 23 asks institutions to hold model records for ten years. Horizon is what happens when long-lived records carry authority without carrying evidence of their own integrity.

The Trap

The trap is retention without integrity. An institution reads paragraph 23, provisions an archive bucket, sets a ten year lifecycle policy and moves on, having preserved exactly the wrong thing, bytes rather than believability. Records held in ordinary infrastructure, writable by the administrators of the party they exonerate, gain nothing from age except doubt. A decade of retention in a mutable store is a decade of accumulated opportunity for the question no institution can currently answer, prove these records were not altered. The parallel trap sits in paragraph 22, dependency fields filled at registration and never updated, so the influence map describes the world as it stood the day the form was completed. Both failures produce an inventory that passes inspection every year until the one year it is actually needed.

The Fix

Design the register for cross-examination, not compliance. The concept level pattern has three parts. First, an inventory whose entries are append-only, where corrections are new records rather than edits, so the register carries its own history. Second, dependency mapping as a living artifact, the data bill of materials pattern from my provenance work, refreshed on change events rather than on anniversaries. Third, and this is the part the ten year horizon makes unavoidable, integrity anchoring, periodic cryptographic commitments of the register’s state to something outside the institution’s own control, so that a future examiner can verify that the record they are reading is the record that existed in 2027. The distinction to internalise is between a diary and evidence. A diary says what you did. Evidence can prove it was not rewritten later. Paragraph 23, read at full strength, is asking for evidence.

The Examiner’s Question

Choose a model you retired three years ago and try to answer, from the archive alone, what it decided, on what data, under whose approval, and who could have altered that record since. If the last answer is our administrators, your ten year memory is a diary, and diaries do not survive cross-examination.

Commentary on a draft under consultation, not legal advice. Paragraph numbers may change at finalisation.