AI Credit Memo Generation: The Provenance Table That Makes the Output Auditable

An internal auditor once asked me where a number came from. The memo said monthly turnover of PKR 4.2M. Clean sentence, sat in the financial summary, nobody had questioned it at committee. That was six months earlier.

I could not reproduce it. Not because it was wrong. Because the analyst who wrote it had computed it by hand from a printed statement, taken a view on which credits were real sales and which were the owner moving his own money around, and written down the answer. The working was in her head and she had left.

That is the problem AI credit memo generation has to solve, and most of the tooling being sold into SME lending right now is solving a different one. The vendors are optimising the writing. The writing was never the hard part. The hard part is that six months later, someone will point at a line in that memo and ask where it came from, and the answer has to be better than a name.

Why the memo is the audit surface, not the scorecard

The scorecard produces one number. The memo produces forty assertions, and every one of them is a claim your institution made in writing about a borrower.

When a file goes bad, nobody audits the score. They audit the memo. They read the turnover line, the existing debt line, the account conduct line, and they ask whether what the memo said was true at the time it was written. That is the whole exercise. A score you cannot defend is embarrassing. A memo line you cannot source is a finding.

The FDIC's 2024 Small Business Lending Survey found that three in four banks approve their typical small business loan within ten business days, and that three in ten, including more than half of large banks, can approve a small and simple loan inside one business day. Those numbers are achievable because the routine files are compressed hard. Compression is exactly the condition under which provenance quietly stops being recorded. The analyst still does the work. She just stops writing down which rows she used.

Put an agent into that pipeline and the compression gets worse, not better. DocuMind can read twelve months of statements in seconds and hand back four thousand classified rows. If the memo it drafts says PKR 4.2M and does not say which of those four thousand rows produced it, you have automated the audit problem rather than fixed it.

The provenance table

This is what a credit memo needs to carry per section for the output to be reconstructable. Nine sections, and for each one: the source the figure must cite, the gate that has to pass before the line gets written at all, and the person whose name is on it.

#	Memo section	Source the figure must cite	Validation gate before the line is written	Signature
1	Borrower identity and group structure	Registration documents, declared related-concern list, counterparty names extracted from the statement	Every counterparty receiving more than 5% of total debits is resolved to a third party or a declared related concern. Unresolved counterparties block the section	Credit analyst
2	Facility request	Application record from Lift, stated purpose, requested tenor	Requested amount reconciles to the stated working capital cycle. A 90 day cycle does not support a 30 day facility ask	Relationship manager
3	Turnover and revenue	Named statement rows, listed by month, with row identifiers retained	Self-transfers and inter-account credits stripped before the average is taken. Twelve unbroken months. Closing balance on each page matches the opening balance on the next	DocuMind output, analyst confirms
4	Existing debt	Declared facility list, bureau file, recurring fixed debits in the statement	Every recurring fixed debit is matched to a declared facility or explicitly flagged as undisclosed. No unmatched residue	Credit analyst
5	Repayment capacity and DSCR	Net operating inflow from section 3, total debt service from section 4	Computed on stripped turnover, never on gross credits. Segment specific floor applied, not a single book-wide ratio	Credit analyst
6	Account conduct	Return charge rows, daily balance series, overdraft utilisation by month	Full period with no month excluded. Bounced instruments counted by instrument, not by charge line, since one return can generate several charges	DocuMind output, analyst confirms
7	Security and enforceability	Charge documents, registration status, valuation with its date	Treated as a stop factor and never scored. An unenforceable or unregistered charge ends the file or escalates it. No compensating strength applies	Credit head or legal
8	Risks and mitigants	RiskRadar signals, analyst narrative	Every named risk traces to a specific figure in sections 3 to 6. A risk with no number behind it is removed, not softened	Credit analyst
9	Recommendation	Policy cutoff, score, exception log reference	Any deviation from policy is logged as a numbered exception with a reason code before approval, not appended afterwards	Approver or credit committee

Copy the table. Run it against the last memo your team wrote. The sections that fail are the sections that will fail in an audit.

The three gates that sit underneath it

Column four does most of the work, and three gates carry most of column four. They are the same shape as the validation workflows regulated lenders already run; the difference is that here they run before a line is written, not after.

Continuity. Nothing downstream is valid if the statement itself does not add up. Page four ending on one balance and page five opening on another means the document set is incomplete or altered, and every figure computed from it inherits that. This gate runs first and it is binary.

Attribution. Money moving between accounts the same group controls is not revenue. Circular transfers between a borrower and its sister concern will pass every extraction accuracy test ever written, because the extraction is correct. The classification is what is wrong. Attribution has to resolve counterparties, not just read them.

Completeness. A recurring debit of the same amount on roughly the same date each month is a facility. If it is not on the declared list, the memo is describing a borrower with less leverage than it has. The gate is that no recurring fixed debit is left unmatched, not that most of them are.

An agent can enforce all three faster and more consistently than a person under backlog, which is the actual case for AI credit memo generation. It is not that the agent writes better prose. It is that the agent never skips the continuity check at 7pm on a Friday.

Run the reproduction test

Take your last ten approved SME files. For each one, pick three numbers out of the memo at random and try to get back to the raw rows that produced them. Give yourself ten minutes per number.

Count how many you reach. That fraction is your real provenance rate, and it is almost always lower than a credit team expects, because the memo reads complete and the gap only shows when someone pulls on a specific line.

Then compare it to the table above and see which of the nine sections your misses cluster in. In every book I have looked at, they cluster in sections 3 and 4: turnover and existing debt. Those two are where an analyst's judgement gets compressed into a single figure with no record of the judgement, and they are also the two sections that decide the facility size. The numbers in a bank statement are where that judgement has to be written down.

Fix the record on those two and the rest of the memo mostly holds. That is worth doing whether or not you ever automate a line of it.

We built Sentinel and DocuMind around the assumption that the memo has to be reconstructable, not just fast. If you want to see what that looks like on a file of your own, send us one real statement and we will show you the provenance trail behind every figure in the summary.