The digital overhaul sweeping global banking is forcing financial institutions to rethink the foundations of their internal control systems.
As cloud platforms, AI engines and automated workflows are being tested and implemented, and quickly replace paper-based supervision and manual review, banks face a fundamental shift: internal control is no longer a static compliance function but an active, data-dependent discipline that must adapt in real time.
For quality assurance and software testing teams, this shift brings both opportunity and pressure. Automated controls, continuous monitoring and model-driven decision-making require new testing standards, new governance mechanisms and far stronger resilience planning than in the past.
These changes are playing out most visibly in large, complex organisations, particularly in the world’s major state-owned banks, where digital transformation programs run at industrial scale.
Among them, China Construction Bank has become one of the most significant case studies of how internal control is being rewired in the digital era because of a recent academic report that was shared with QA Financial.
The study, by Lund University in Sweden, called ‘The impact of digital transformation on corporate internal control: Based on the case analysis of China Construction Bank’, offers rare insight into how this transformation affects software testing, digital resilience and internal-control design in a major financial institution.
Based in the Chinese capital of Beijing, China Construction Bank (CCB), formerly known as the People’s Construction Bank of China, is one of China’s largest state-owned commercial banks and one of the biggest financial institutions in the world.
Established in 1954, it operates more than 14,000 branches, serves hundreds of millions of retail and corporate customers, and maintains a global presence across 31 countries and regions.
Its transformation therefore provides a uniquely detailed view of how digitalisation reshapes risk management, operational resilience, software testing and governance inside a systemically important bank.
Real-time digital controls
The bank’s internal control system is now deeply intertwined with cloud infrastructure, AI tools and automated workflows.
The researchers wrote in the report that digital control “combines multiple engines such as automation, artificial intelligence, data analysis and workflow to help enterprises’ control activities rely on data to drive” and ensures that “control no longer relies on sample testing, but analyses all data in the enterprise and the system automatically identifies” issues in real time.
Employees confirm that the shift has changed their daily work fundamentally. One interviewee stated that “every operation of CCB employees will leave a trace and be real-named, and the trace of employees’ operations can be queried in the system.”
Another added that “the system will remember every step of the employee’s operation, so employees cannot secretly tamper with the data.”
This shift away from after-the-fact review is structural. The report emphasised that Chinese enterprises are moving from “the ‘after-the-fact remedy’ thinking of traditional control to the ‘real-time intervention’ thinking of digital control,” with processes embedded directly into systems because “cumbersome documented processes in the past are difficult to adapt to the current high-frequency trading” environment.
AI expands both capabilities and risks
CCB’s expansion of AI throughout credit approval, risk pricing and fraud identification has transformed both the opportunity and the risk profile of its internal control system. #
The bank tested and introduced a “model lifecycle management system and an independent review mechanism to improve the controllability and explainability of model risks.”
Interviewees pointed to real challenges emerging from this shift. With widespread use of AI models in operations, “potential problems such as algorithm bias, model aging, and black box decision-making have emerged,” resulting in “increased uncertainty in risk identification.”
One participant noted that the bank has responded by building “a model risk identification mechanism and an AI-assisted assessment platform,” using techniques such as natural language processing and graph computing to “realise automatic parsing of customer reports and identification of abnormal transaction behaviors.”
Raising the stakes for resilience
The transformation also includes one of the largest core-system restructurings among global banks.
CCB has “fully completed the switch of distributed core systems,” and the new architecture “will carry more than 94% of the bank’s core transactions,” the report stated. This shift raises the bar for environment stability, failover testing and automated deployment pipelines.
Yet the report noted that “high automation makes the internal governance of banks more complicated,” and many banks “cannot realise that the old internal control system can no longer adapt to the new development requirements.”
For QA and testing teams, this reinforces the need for more rigorous test governance and continuous integration practices.
“High automation makes the internal governance of banks more complicated.”
– Author Yucheng Zhang
Digitalisation also hardened the bank’s stance on authority, discipline and traceability. One interviewee said the bank “absolutely does not allow overstepping of authority,” and that “each system will also set relevant responsible persons at key nodes; when a problem occurs, it can be traced back to all relevant responsible persons step by step.”
Another added that older shortcuts, such as “the ‘green channel’ for past loans,” are “no longer feasible.”
This is supported by the report’s description of new digital enforcement mechanisms, including process traceability, automated logs and embedded control points that “eliminate skipped steps.”
The challenge of keeping up
As the transformation accelerates, CCB faces pressure to equip its workforce with new digital skills. One participant stated that “the talent concept of CCB is to respect talents, make good use of talents, and retain talents,” and noted that technical talent “is related to the lifeblood of our company’s sustainable development.”
The report highlights that the bank held “more than 40,000 training sessions in 2023, covering more than 2 million employees,” showing how deeply the transformation reaches into every layer of the organisation.
Yet interviewees acknowledged that the shift is uneven. One noted that the talent structure “does not match the actual needs,” and that in many organisations undergoing digitalisation “the gap in digital literacy among employees is large.”
The study concluded that digitalisation “significantly enhances internal control efficiency” but also creates “new challenges including technology dependency, data security risks, and institutional misalignment with emerging digital governance demands.”
For QA and testing teams, the CCB case shows that internal control is now inseparable from software testing, model validation and automated monitoring.
The transformation of China Construction Bank demonstrates that digital resilience is not simply a technology upgrade, it is a continuous discipline requiring stronger testing frameworks, deeper integration of AI oversight and a reimagining of how control is executed inside a modern financial institution.
COMING IN 2026
Why not become a QA Financial subscriber?
It’s entirely FREE
* Receive our weekly newsletter every Wednesday * Get priority invitations to our Forum events *
REGULATION & COMPLIANCE
Looking for more news on regulations and compliance requirements driving developments in software quality engineering at financial firms? Visit our dedicated Regulation & Compliance page here.
READ MORE
- Goldman puts AI coding to the test
- How to test AI models that banks do not control
- OpenAI, Filigran and SunTec: the latest vendor and product news
- Sygnum: Testing AI is ‘a measurement problem’
- Banks’ ‘code for all’ push raises testing risks
QA FINANCIAL PODCASTS
LISTEN TO OUR EXCLUSIVE CONVERSATIONS
WATCH NOW
