Governed IPV: from a breach to a sign-off auditors can check

The setup

Take a Level 3 position — say a long-dated European swaption beyond the tenors brokers quote. The trading desk marks it. Valuation control prices it independently against a consensus volatility source. The gap lives almost entirely in one unobservable input: the normal-vol mark on a specific expiry-by-tenor node. Today, closing that gap is a meeting — spreadsheets, emails, and screenshots — and the record of who decided what is rebuilt later.

How a governed run changes it

The agent may propose the comparison and draft the note. The comparison itself runs on an approved, deterministic pricing engine, bound to committed inputs, under a versioned tolerance policy. The agent cannot approve the mark or conceal a breach.

• Deterministic recompute. The same approved Bachelier engine prices the desk’s inputs and the independent inputs, so any difference is attributable to inputs, not implementation.
• Attribution to the node. The gap is decomposed to the specific unobservable input driving it, so the conversation is about that vol mark, not “your number versus mine.”
• Tolerance by fair-value level. The tolerance is keyed to the position’s fair-value hierarchy level, set by its lowest-level significant input — tighter for Level 2, wider where the position is genuinely Level 3.
• Commitments, not copies. The evidence carries content digests of the curves, the vol surface, and the positions. Licensed consensus data and the book do not have to be redistributed to be verified.

From a meeting to a governed sign-off

Within tolerance, a position clears automatically, with a receipt. When it breaches, no single function can quietly fix the mark. Valuation control prepares, a reviewer signs the same committed result, and material breaches escalate to the valuation committee. Because each position is independently recomputed and committed, the month-end book rolls up into a single batch root: one batch sign-off over N positions, not a per-trade ceremony.

The same run sizes the valuation reserve for market-price uncertainty from the position’s vega and the dispersion of the consensus source — so the reserve comes from the computation that flagged the breach, not from a separate spreadsheet.

What the auditor gets

Every reconciliation emits an Evidence Pack: the input commitments, the pricing engine’s digest, the prices, the tolerance policy, the approvals, and the runner’s signed receipt. An auditor with the right entitlement can rerun any row and confirm it matches.

• The control is demonstrable, not asserted in a memo.
• Licensed data and the full book are not redistributed to be verified.
• The reserve and the sign-off are tied to the same computation that produced the number.

When the parties are different institutions

Between institutions — contributors to a consensus pricing service, a fund manager and its administrator, counterparties in a margin dispute — confidentiality becomes the real problem. Verify without revealing covers how their inputs can be pooled in an attested environment without any party seeing another’s.