Four weeks to prove what it deliveredPDFFull case in the playbookPortfolio
Readiness pack  ·  compliance architecture  ·  worked case no. 2

Four weeks to prove what it delivered

A funding assurance review lands on a provider that believes it is fine. Four weeks to find out whether the record can prove what the learners achieved, without creating a single file after the event.

An illustration. The provider, its figures and its people are invented, to show the method in use: a wrong turn, a dilemma the method did not settle, and what it cost.

The organisation
FormA company limited by guarantee IncomeAbout £4 million DeliveryApprenticeships and adult skills from four centres in the north of England SubcontractingA third of its learners taught by two subcontractors StandingA good last inspection; learners achieve, employers renew SituationA realignment under a deadline. The risk is disbelief, not panic.
The shape of the outcome
  • The sample comes back satisfactory, under the five-per-cent line, with findings on off-the-job evidence at the subcontractor; the specific errors are recovered by offset
  • A complete learner file in minutes for directly taught learners, and within the day for subcontracted ones
  • The rerun comprehension check passes nine in ten
Fieldwork
4weeks
from the notice, third week of September 2026
Self-test
approx. 8%
projected error rate on the subcontracted trade
The line
5%
the error rate the review turns on
Mid-programme
40
apprentices at the subcontractor
Prepared byChristopher I. V. Farmer · Geneva
SourceNobody Else Is Coming, first edition (October 2026), chapter 11, pp. 43–44
Referencedoi:10.5281/zenodo.23462160
Readiness pack  ·  Four weeks to prove what it deliveredAn illustration
1 · The notice

“Presumably this is fine”

The notice arrives in the third week of September 2026: a funding assurance review, fieldwork in four weeks, the sample to follow a week or two before it. The managing director forwards it to the new compliance manager, three weeks into the job.

The provider is succeeding by its own measures. Learners achieve, employers renew, the inspector was kind, and the board believes the review is a formality. The five opening questions find a clock, a decision-maker, a scattered record and a definition of done that reaches past the review itself.

The clock
4 weeks
to fieldwork; the last learner-data return for the year shortly after
The decision-maker
The MD
and a board of five, two of them the founders
Access
3 systems
that do not talk to each other, two subcontractors’ filing cabinets, and a great many inboxes
Kind of situation
Realignment
under a deadline; the risk is disbelief, not panic

The first week: the self-test

The operator does not wait for the sample. Using the department’s published list of common findings as a checklist, the team tests every learner who started in the last funding year on the five fields the findings name most often (overleaf). Two things surface in the first week.

Definition of done

  • A satisfactory result on the sample
  • No file created after the event
  • The subcontractors’ evidence brought inside the provider’s own record
  • A system that would pass the same review next year without a four-week sprint
Found in week one

One subcontractor’s files for apprentices in one trade have off-the-job training records that do not reconcile to the hours claimed.

The same subcontractor has no data-processing agreement with the provider at all, although it holds the learners’ personal data on the provider’s behalf.

Prepared by Christopher I. V. Farmer · from Nobody Else Is Coming (2026), chapter 112 / 6
Readiness pack  ·  Four weeks to prove what it deliveredAn illustration
2 · Diagnosis

The record is the constraint

The decisive constraint

The provider cannot produce a complete learner file in less than a day, and no one owns the subcontractors’ evidence.

The five fields the self-test checked, from the department’s published list of common findings

Field 1Start dates, with evidence of learning
Field 2Breaks in learning
Field 3Planned hours
Field 4Eligibility and prior attainment
Field 5Learning support, with monthly evidence of the adjustments made

The three risks

  1. The off-the-job shortfall pushing the error rate over the five-per-cent line.
  2. The missing processing agreement: personal data held on the provider’s behalf with nothing governing it.
  3. Staff who, under pressure, might complete files after the event, which would turn a funding error into something much worse.

The arithmetic that persuaded the managing director

The managing director regards compliance as the department of no. He is persuaded by arithmetic, not argument: the self-test projects an error rate of around eight per cent on the subcontracted trade, and an unsatisfactory result would cost more in recovered funding and self-audit than the subcontract earns in a year.

Why disbelief is the risk

A provider that is succeeding by its own measures does not expect its record to fail. The review does not retest the teaching; it asks whether the evidence of it can be produced, field by field, on the day.

0%2.5%5%7.5%10%8%Subcontracted trade, projected from the self-testthe 5% line
Error rate on the subcontracted trade, projected from the week-one self-test, against the five-per-cent line the review turns on. The review’s sample later came back under the line. Figures invented.
A complete learner file
A dayor more
to produce, before the sprint
Owner of the subcontractors’ evidence
None
before the sprint
Prepared by Christopher I. V. Farmer · from Nobody Else Is Coming (2026), chapter 113 / 6
Readiness pack  ·  Four weeks to prove what it deliveredAn illustration
3 · Stabilise, then build

Nothing created after the event

12345678910WeekNotice; self-test against the published common findings; two findings surfaceWritten instruction: correct, record what is missing, create nothing from the pastA dozen chatbot-written progress reviews found; breach logged that day, reported within 72 hoursData-processing agreement signed; subcontractor’s access restricted until it wasFieldwork, four weeks from the noticeAttestation workflow automated before the policy library was mergedComprehension check a month later: barely six in ten
Dated events in the case, from the week the notice arrived. The library merge and the rerun attestations followed the comprehension check; the obligations pipeline was run by hand for six weeks after the review and then automated.

Stabilise: before the sample

  • The first instruction to the whole team, in writing, is the one that matters most: correct the learner data where the data is wrong, record what is missing, and create nothing that pretends to be from the past.
  • The evidence pack is defined for every funding stream and indexed.
  • Errors that can properly be corrected in the learner data before the hard close are corrected, each one logged and approved.
  • The processing agreement is signed in week two, and the subcontractor’s access to the provider’s systems is restricted until it is.

Build: after the review, not before

  • Validation at the point of entry.
  • A weekly exception report.
  • A quarterly file sample of each subcontractor.
  • The obligations pipeline, run by hand for six weeks and then automated, with the operator as the named decision-maker.
  • An AI rule: a review is the tutor’s own account of what the learner did, signed by the tutor, and drafted in an approved tool if drafted in one at all.
What would make next year’s review ordinary

Validation where the data is entered, an exception report that runs every week, and a sample of the subcontractors’ files every quarter, so that the sprint would not be needed again.

The instruction that mattered most, in writing, to the whole team

Correct the learner data where the data is wrong, record what is missing, and create nothing that pretends to be from the past.

Prepared by Christopher I. V. Farmer · from Nobody Else Is Coming (2026), chapter 114 / 6
Readiness pack  ·  Four weeks to prove what it deliveredAn illustration
4 · The AI episode, and the wrong turn

Clicking is not understanding

Found in the self-test

A dozen progress reviews, written by a busy tutor with a public chatbot, that read beautifully, contain the learners’ names and employers, and describe progress the learners’ own records do not show.

Because the tool’s terms let it keep and use what was typed into it, the episode was logged that day as a personal-data breach and reported to the regulator within seventy-two hours of being found. The reviews were withdrawn and redone with the learners; the tutor was retrained, not dismissed.

The AI rule, as adopted

A review is the tutor’s own account of what the learner did, signed by the tutor, and drafted in an approved tool if drafted in one at all.

What went wrong

The operator automated the policy-attestation workflow in week five, before the policy library had been merged. Staff received forty-one attestation requests in a fortnight. Completion reached ninety-eight per cent; the comprehension check a month later found that barely six in ten could answer the basic questions on the safeguarding policy they had attested.

The attestation rate had measured clicking. The library was merged into nine policies, the attestations were rerun, and the operator added a line about fixing the process before automating it to her own notes: a rule she had, after all, been taught.

Before the library was mergedAfter the merge and rerun
0%25%50%75%100%98%Attestations completed60%90%Could answer the basic questions
Completion against comprehension on the safeguarding policy: ninety-eight per cent completed; barely six in ten could answer the basic questions a month later; nine in ten after the rerun. Figures invented to show the shape of the finding.
Attestation requests
41
in a fortnight, in week five
Policies after the merge
9
from a library that had never been merged

The breach, step by step

In the first weekA dozen reviews found in the self-test, written with a public chatbot
The same dayLogged as a personal-data breach: the tool’s terms let it keep and use what was typed in
Within 72 hoursReported to the regulator
ThenReviews withdrawn and redone with the learners
The tutorRetrained, not dismissed; the AI rule adopted
Prepared by Christopher I. V. Farmer · from Nobody Else Is Coming (2026), chapter 115 / 6
Readiness pack  ·  Four weeks to prove what it deliveredAn illustration
5 · The dilemma, the outcome, and what to take from it

Whether to end the subcontract

The dilemma the method did not settle

The evidence at the subcontractor was weak and the board’s instinct was to terminate. But forty apprentices were mid-programme with employers who had chosen that subcontractor for its trade expertise, and ending it would have harmed the learners for a failing that was the provider’s as much as the subcontractor’s.

The board chose a remediation plan with a deadline, a full file check at six months and termination as the stated consequence of missing it, and recorded the minority view that it should have ended there and then. The method made the choice visible and the reasons durable. It could not make the choice.

The shape of the outcome

  • The sample comes back satisfactory, under the five-per-cent line, with findings on off-the-job evidence at the subcontractor; the specific errors are recovered by offset.
  • Complete files can be produced in minutes for directly taught learners and within the day for subcontracted ones.
  • The rerun comprehension check passes nine in ten.

These figures are invented to show the shape of an outcome, not to describe one.

Copy

  • The self-test against the published findings, before the sample arrives
  • The written instruction that nothing is created after the event
  • Processing agreements before data moves
  • The AI rule
  • Measuring comprehension as well as completion

Do not copy

  • The tools, the thresholds or the timetable
  • Waiting for a review notice to find out whether you could pass one

Read the full case in the playbook

This brief follows the worked case at the end of chapter 11, “Compliance architecture”, of Nobody Else Is Coming: An Operator’s Playbook for Crisis, Compliance and Capital (first edition, October 2026), pp. 43–44. The chapter sets out the operating model the case applies: culture, the obligations pipeline, AI behind a human gate, funding assurance, data protection after the 2025 Act, safeguarding and speak-up.

Open chapter 11 at the case ›doi:10.5281/zenodo.23462160This brief as a PDF

Status. An illustration: the provider, its figures and its people are invented, and no former employer’s, client’s or funder’s information appears in it. Not legal advice. The law and guidance are stated as at October 2026 for England, as in the playbook. Licence CC BY-NC 4.0, as for the playbook; commercial use needs a licence from the author. Author Christopher I. V. Farmer, LL.M. (University of Worcester), independent researcher, Geneva · https://civfarmer.github.io/

Prepared by Christopher I. V. Farmer · from Nobody Else Is Coming (2026), chapter 116 / 6