AI for Financial and Clinical Risk Reporting: The EPC Playbook

Because the underlying Microsoft architecture is identical. Both disciplines depend on regulated source data (PHI for clinical, MNPI and customer financial data for financial services), require audit-pedigree controls (HIPAA Security Rule §164.312(b) for clinical, FFIEC IT Examination Handbook and FRB SR 11-7 for financial), need AI grounding that does not leak sensitive labels into prompts, and must produce regulator-ready dashboards with row-level security and immutable audit logs. Microsoft Fabric Lakehouse, Microsoft Purview, Power BI, and Microsoft 365 Copilot are the same building blocks in both verticals. EPC Group packages the methodology once and reuses it across financial services and healthcare clients, which is why the same senior architect bench delivers SR 11-7 model risk dashboards for a regional bank in the morning and sepsis prediction dashboards for a multi-state health system in the afternoon. Combining the practice areas also lets EPC apply lessons from one regulated discipline to the other — for example, FDA 21 CFR Part 11 ALCOA-C electronic-records controls inform financial model attestation patterns.

FRB SR 11-7 requires three lines of defense around model risk: model owners, model validators, and internal audit. Inside the Microsoft stack, EPC Group implements this as follows. Model artifacts (champion model, challenger models, back-test results, sensitivity analyses, validation reports) are stored as governed data products in a Fabric Lakehouse zone with Microsoft Purview sensitivity labels applied at ingestion. A Fabric Warehouse holds time-series snapshots of model inputs and outputs with row-level security splitting visibility between model developers, validators, and auditors. Power BI dashboards expose validation evidence with visual-level RLS. Microsoft Purview captures lineage from raw input through model output to the dashboard cell — auditors can drill from a number on a screen back to the source extract. Microsoft Purview audit logs cover read events, not just write events, satisfying the SR 11-7 expectation that all three lines of defense can demonstrate independent evidence of who saw what when. Copilot in Power BI is configured with grounding restricted to validated artifacts, preventing speculative model commentary from leaking into board-pack narratives.

Copilot grounding is governed at three points. First, Microsoft Purview sensitivity labels (Restricted-PHI, Restricted-Research, Confidential-Operational) are applied at the data product layer in Fabric, propagating into downstream Power BI semantic models and into SharePoint and OneDrive sources surfaced through Microsoft Graph. Second, Copilot inherits these labels — a prompt that would surface PHI to a user who lacks the corresponding Microsoft Entra group membership is filtered before the response is rendered. Third, EPC Group configures Copilot Studio agents with grounding restricted to pre-approved semantic models and SharePoint sites; clinical decision support agents cannot reach into the open web or into unlabeled lakehouse zones. Microsoft 365 Copilot inherits HIPAA Business Associate Agreement coverage when configured inside an environment with an executed Microsoft BAA, which EPC Group sets up during Week 1 of any healthcare engagement. Errin O’Connor — nearly three decades of Microsoft consulting leadership and a four-time Microsoft Press & Sams author — has published these grounding patterns in EPC field guides distributed to healthcare CIOs.

Regulators including the FRBNY (Federal Reserve Bank of New York), OCC, FDIC, and FINRA have not banned generative AI in risk reporting workflows — they expect the same model risk management discipline applied to traditional models. FRB SR 11-7 covers conceptual soundness, ongoing monitoring, and outcomes analysis. The OCC 2023 risk perspective explicitly addressed generative AI, expecting banks to demonstrate explainability, bias controls, and human-in-the-loop validation for any AI-influenced decision affecting customers. EPC Group configures Microsoft 365 Copilot for financial risk reporting as an augmentation layer — Copilot drafts narrative commentary on variance reports, summarizes BSA/AML alert narratives, and proposes investigation paths, but every output is reviewed and attested by a human analyst whose Microsoft Entra identity is logged. Microsoft Purview audit logs capture both the prompt and the grounding sources, satisfying examiner expectations that the bank can reconstruct any AI-influenced output on demand. Copilot is configured with sensitivity-label awareness so MNPI cannot accidentally surface in unrelated workflows.

Yes, with the correct configuration. FDA 21 CFR Part 11 requires electronic records and electronic signatures to satisfy ALCOA-C: Attributable, Legible, Contemporaneous, Original, Accurate, and Complete. Power BI workspaces surfacing clinical decision support data must enforce Microsoft Entra single sign-on (Attributable), enable audit logging at both Power BI Service and Fabric storage layers (Contemporaneous and Complete), preserve original source extracts in OneLake immutable storage (Original), and apply version control to the semantic model and report definitions through Fabric deployment pipelines (Accurate and Legible). EPC Group also documents the system in a 21 CFR Part 11 Statement of Compliance, validates the configuration through Installation Qualification, Operational Qualification, and Performance Qualification scripts, and maintains the validation artifacts inside Microsoft Purview as governed data products. For clinical decision support tools that meet FDA Software as a Medical Device criteria, EPC partners with the customer’s regulatory affairs team to navigate the 510(k) or De Novo pathway. The architecture itself does not make a SaMD determination; that is a regulatory question requiring counsel.

Sepsis prediction models are sensitive to data quality across vital signs, laboratory results, medications administered, and clinical observations. EPC Group implements data quality at three layers inside Microsoft Fabric. At the bronze layer, raw HL7 v2 and FHIR R4 feeds from Epic, Cerner / Oracle Health, or Meditech are ingested with schema validation and lineage capture. At the silver layer, clinical concepts are mapped to a standardized vocabulary (LOINC for labs, RxNorm for medications, SNOMED CT for diagnoses) and timestamps are aligned to a single clinical timeline. At the gold layer, a feature store presents the named clinical features used by the sepsis model (qSOFA components, lactate trajectory, mean arterial pressure, white blood cell count, heart rate variability) with explicit handling of missingness — sepsis models that silently impute missing lactate values produce dangerous false negatives. Microsoft Purview captures end-to-end lineage so when a clinician asks why the model flagged a patient, the answer can be traced from the dashboard cell back to the original observation. Active healthcare clients providing reference architectures include Palmetto Infusion (active BAA), the American Registry of Radiologic Technologists (ARRT), the Oklahoma Medical Research Foundation (OMRF), Eisenhower Health, and Medavie (BAA + HIPAA + ECIF).

BSA/AML alert investigation is dominated by false positives — typical bank AML programs see 95-98% of alerts close as no further action. The cost is investigator time. EPC Group deploys Microsoft 365 Copilot inside the AML investigation workflow to draft initial alert narratives, surface related party network views from Microsoft Fabric warehouses, and propose investigation paths grounded in the bank’s case-management history. The Copilot output is not a final disposition — it is a structured first draft that a human investigator reviews, edits, and attests through a Power Apps form that writes the final disposition back to the case-management system. Microsoft Purview audit logs capture the Copilot prompt, the grounding sources retrieved, the human edits applied, and the final attested narrative — satisfying FFIEC BSA/AML Examination Manual expectations that the investigation reasoning be auditable. Field results from EPC engagements indicate investigator throughput improvements without measurable change in Suspicious Activity Report quality, because the human-in-the-loop attestation pattern preserves examiner trust.

EPC Group does not build proprietary credit models, market risk VaR engines, or sepsis prediction algorithms — those are vendor or internal-quant deliverables. EPC Group builds the Microsoft architecture that hosts, monitors, governs, and reports on those models. For financial services clients, that means integrating models from SAS, Moody’s, Numerix, MSCI, or internal Python and R artifacts into Microsoft Fabric with full SR 11-7 lineage. For healthcare clients, that means integrating clinical decision support models from Epic Cognitive Computing, Cerner / Oracle Health, Jvion, or internally-developed Azure Machine Learning artifacts into the Fabric Lakehouse and Power BI surface. The build vs buy decision belongs to the customer’s quant or clinical informatics team; EPC Group’s role is making whichever model the customer chooses operate inside a Microsoft Solutions Partner architecture that survives examiner and surveyor scrutiny. This division of labor keeps engagements fixed-fee and senior-architect-led, with delivery from the same bench that has produced 70+ Fortune 500 engagements and 216+ M&A tenant migrations.