The Model Works — But Can You Trust It?
Raef Lawson, Executive Director of the Profitability Analytics Center of Excellence, recently posted what looked like an accountant's joke and turned out to be a diagnosis. The title: "Frauds That Passed Every Spreadsheet Test." Below it, six names: Enron, WorldCom, Satyam Computer Services, Allied Irish Banks, the City of Dixon (Illinois), and the Aldie Volunteer Fire Department.
What did they have in common? The numbers added up. Every one of those models passed the technical tests a controller would run today: consistent sums, clean reconciliations, structural validations with zero errors. And every one of them was completely wrong.
Here is the detail almost no one catches, and it sharpens the message instead of weakening it. Five of the six are not profitability-model frauds. They are financial-reporting frauds or embezzlements: Enron with its SPEs and mark-to-market, WorldCom capitalizing opex, Satyam with fictitious cash, Dixon with municipal embezzlement, Aldie with a treasurer who drained the account. Only Allied Irish/Allfirst is a market-risk control failure. None is, strictly speaking, a fraud of the profitability model itself.
That does not break the argument. It focuses it. The calculation was never the point of failure. What failed was the chain of trust around the model. And in Profitability Analytics that chain is more fragile than in financial reporting, because models of allocations, drivers, cost-to-serve, customer/product profitability, and transfer pricing live outside the GAAP perimeter. Nobody outside the company reviews an allocation Rule Set the way the balance sheet gets reviewed. That is where the gap sits.
Three questions organize the rest of this article.
- Why can a model that passes every technical test still produce the wrong decisions?
- How do you build trust in a model that no regulator reviews?
- What should a CFO do this week to close that gap?
1. Why the Perfect Model Lies
The starting error is believing the risk is "calculation risk." It isn't. A well-built profitability model can sum perfectly and still hand you the wrong decision signal. The real risk is distributed across four places, ordered by where they bleed in an EPCM/PCM environment.
| Risk | What fails | Where it shows up in PCM/EPCM |
|---|---|---|
| Assumption | The driver was chosen to reach a desired number, not for causality | "Political" allocation drivers: the loudest department gets charged the least |
| Data Lineage | No one knows where the input feeding profitability came from | A macro-process with embedded commas breaks the POV parsing. The number sums, but it's mapped wrong |
| Management Override | A privileged user changes a rule and leaves no trace | A Copy Rule with untrustworthy inheritance becomes a silent override |
| Interpretation | The executive decides on a KPI they don't understand | "Profitable product" when the profitability is an artifact of the allocation, not of the market |
The knot tying all four together is the reconciliation trap. A profitability model can reconcile 100% against the GL and, at the same time, emit false decision signals. Reconciliation validates that it sums. It does not validate that the causality is correct. Those are two different questions, and most committees treat them as one.
I saw this with painful clarity during a live review of the Profitability and Cost Management model at a LATAM bottler that competes with PepsiCo. I can't name them. It was a serious model, with two stages, 88 activities, 17 dimensions, Rule Sets RS00 through RS06, and twelve months of batch runs without incidents. The structural validation report came back empty. Zero errors. Coherent architecture.
"The model passed every test. What else is there to review?" asked the CFO, with the calm of someone who believes the problem is already solved.
That question, asked in good faith, is the Interpretation risk in its purest form.
If the technical tests can't detect the risk, the control can't be technical. It has to be governance.
2. How to Build Trust Outside the GAAP Perimeter
Banking solved this problem fifteen years ago and called it Model Risk Management. The Federal Reserve's SR 11-7 letter treats a model as an asset to govern. Its logic transfers cleanly into the EPCM world, whatever the local regulator (CNBV in Mexico, SIB in Guatemala, SBP in Panama, SB-RD in the Dominican Republic). Three layers, three questions.
| Layer | Question | Controls |
|---|---|---|
| 1 · Development | Is the model sound? | Documented methodology, signed assumptions, declared limitations; every Rule Set with its causal rationale |
| 2 · Independent Validation | Did someone independent challenge it? | Backtesting, sensitivity, benchmarking; champion vs. challenger; whoever validates ≠ whoever built it |
| 3 · Governance | Is it controlled in production? | Model inventory + tier, version control, segregation of duties, change log, approval workflow |
Four frameworks reinforce the structure. SR 11-7 supplies the three-layer architecture. BCBS 239, already mandatory for regional banking, demands data lineage and traceability. A model is only as good as the data feeding it. And for the layer that's coming, NIST AI RMF (Govern / Map / Measure / Manage) and the EU AI Act already warn that AI risk can't be managed with technical controls alone.
What sets this apart is substance. The Decision-to-Value™ method we apply at Asher is built on economic causality, not accounting convenience. Every allocation has to trace back to a driver that causes the cost, and every driver has to connect to a decision. That standard is what gets a model out of the reconciliation trap.
Back to the bottler, because that's where the theory turned into evidence. The review the CFO thought was unnecessary surfaced three findings the native validation was never going to see.
| Finding | Risk type |
|---|---|
| The RS06 offset pointed to Source instead of Alternate, which is fragile under any re-sequencing | Change / Override |
| The RS06 description read "transactions and orders by SKU," but the orders rule was disabled | Interpretation |
| A parallel legacy rule, disabled, shared the sequence, creating a latent double-counting risk | Version / Lineage |
The second finding is the heart of the matter, and I want to be precise about it. It was honest documentation drift. The description said one thing, and the active logic did another. No one lied. But the mechanism is identical to Enron's: trust placed in a number whose methodology differs from what the reader believes. Same mechanism, different intent. That distinction widens the argument. Governance protects against fraud, and also against silent error. Silent error is far more common, and for that reason far more dangerous.
How do you prove the calculation is valid without touching the client's real data? With three invariants. Conservation: the cost entering each stage must equal the cost leaving it. Take a synthetic scenario with 100 units of cost flowing through three allocation steps. After each stage, debit and credit must both still total 100. A single cent of drift fails the invariant, and you've caught it before it ever touched real data. Traceability: every output amount is traced back to its origin through the driver and recomputed by hand. Determinism: same inputs, same outputs, on every run. Eight synthetic cases with known answers and an independent Excel oracle (literally, Layer 2) close out the assurance.
Once we know what controls trust, the operational question is where to start on Monday.
3. What to Do This Week
The actions are ordered by trust ROI, by where a unit of effort buys the most certainty. Difficulty doesn't enter into it.
- Profitability Model Inventory. Every active model with owner, criticality tier, last validation, and regulatory scope. Without an inventory there's no governance; there's folklore.
- Signed Assumption Register. Every key driver with its source, its causal logic, and a business owner who signs it. The signature turns the assumption into accountability.
- End-to-end Data Lineage. From source system to final POV. BCBS 239 already requires it in banking; every other industry is just running late.
- Segregation of duties in the Rule Sets. Whoever builds does not approve. This one, alone, kills the silent override.
- Champion vs. Challenger on one client. Run the causal model against the status quo and show the delta. It's the most sellable proof of value there is. The number that changes is the argument.
- Explainability layer. Before every decision: "this number comes from this driver, under this assumption." If you can't say that sentence, you shouldn't be deciding.
If I had to pick one to start on Monday, it would be the first. The Model Inventory is trivial to begin. One sheet, one owner per model. It immediately exposes how many critical models run without a clear owner. That figure, in most organizations, is uncomfortable. That is why it works.
And one more layer multiplies all of the above. AI Model Governance. With GenAI entering the decision flow, the risk goes up. A model can be 95% accurate and still be biased, out of context, or unexplainable. The discipline is the same as before. Keep an AI model register beside the profitability inventory, a change log that lets any output be reproduced and challenged, and a review cycle that tests bias and explainability as well as accuracy. StrategicFinance.ai™ pairs its anti-hallucination architecture with a full trace of every output, which is Model Governance applied to AI. Whoever governs their profitability models today is building the foundation that AI regulation will demand of them in twelve to twenty-four months. The EU AI Act has already set the direction.
Locate your organization on this maturity scale.
Most FP&A functions in the region live between levels 1 and 2 and believe they're at level 3 because their models reconcile. The distance between "it reconciles" and "it can be trusted" is the work that remains.
A perfect model can still be untrustworthy. Enron was a failure of governance, and Excel had nothing to do with it. Good governance proves the model can be trusted, which is a different claim from proving it works. For a regulated CFO, that is the only definition of "valid model" that survives a wrong decision.
The model runs. Whether it can be trusted is a separate question.
And that difference, today, is the CFO's job.
