When the *documentation is missing*: lessons from a billion-kronor file gap

When the file isn't there

Folksam could not present requested documentation to Finansinspektionen about its risk investigation concerning billion-kronor investments in Heimstaden Bostad, according to Affärsvärlden. ^[1]

The details of what FI asked for, and why the documentation was missing, are not yet public. What is clear is the pattern. When a supervisor, an auditor or a court asks for records of what you knew and when, the burden is on you to produce them. If you cannot, the assumption tends to go against you.

It is like when your bank asks for receipts. If you say the invoice existed but you cannot find it, the bank does not tend to believe you over the seller.

What DORA requires

Since 17 January 2025, financial firms have had to meet the technical standards on ICT risk management under DORA. ^[2] One requirement often passes with less attention than it deserves: logs and records must be protected against tampering, deletion and unauthorised access. ^[3]

A log or a risk assessment is what tells you, and everyone who asks, what happened and what you knew. For it to hold up, people have to be able to trust it. That is harder than it sounds when the people keeping the log are the same people who could change it.

Access controls and monitoring are the foundation. An independent record of what a file or a log contained at a given time goes one step further, because it shows whether anything has changed, even by someone with the right access.

The evidence question

Here, the evidence question is straightforward: can you show what your risk assessment said on the day you completed it, and that it has not been edited since?

If the answer is no, the next question is harder: why should anyone believe your version over someone else's?

This is not a question about Folksam specifically. It is a question every organisation that handles risk, compliance or financial decisions will eventually face. The cases that reach the headlines are the ones where the answer was no.

What this means for you

If you work with risk, compliance or investment decisions at a financial firm, here are three questions worth asking this week:

• Do we have a central place where risk assessments, committee minutes and investment decisions are stored, and who decides what goes in?
• Could we show, if FI or an auditor asked, what a specific risk assessment or decision memo said six months ago, and that it has not been changed since?
• Are access logs for those records themselves protected, so we can show who opened what and when?

The first question is about process. The second and third are about proof.

How a digital witness fits here

This is a case where a digital witness would have made the answer to the second question simple.

The thing to seal is each risk assessment, investment decision or committee minute when it is finalised and approved. Sealing takes a fingerprint of the document, not the document itself, so the content never leaves your systems. The fingerprint is sealed on WitniumChain, and you get a witness ID back.

If the document is questioned later, anyone you share it with can check that it is the same one sealed on that date. Change a single character and the fingerprint will not match. Even someone with administrator rights cannot quietly edit a sealed record without the change showing.

The check is quick: recalculate the fingerprint and compare it with the sealed one. A match means the document has not changed. A mismatch means it has.

What the witness does not do is replace your archiving system, your approval workflows or your access controls. It adds one layer: proof that a record existed at a certain time and has not been edited since.

How it would work

1. Seal the risk assessment or decision memo when it is finalised, before or as it goes into the archive.
2. Store the witness ID with the document.
3. If it is questioned, share the document and the witness ID. The recipient checks the fingerprint and sees whether it matches.

Your system calls WitniumChain through the REST API, the SDK or the MCP server. The first 2,000 witnesses a month are free. Read more in the docs.

What to watch

FI's supervision under DORA is ongoing, and more cases like this one are likely to surface as supervisors test whether firms can actually produce the records the rules require.

The next date worth marking is 17 July 2025, when firms must test their ICT systems and report the results. ^[4] Those test reports will themselves be records someone may ask for later.

In the long run, the question is not whether your records exist. It is whether you can show they have not changed since the day you say they were written.