Risk and compliance

AI adoption by role

Risk and compliance is not one reviewer. It is six distinct lenses, each with its own question, authority and record: AI (artificial intelligence) and model risk, privacy, legal, compliance, records, and third-party risk. A use case gets the lenses its tier and its data call for, and each lens records what it decided. There is never one omnibus "risk sign-off".

This track also shows where internal audit sits: outside the second line, as an independent third-line interface. Counts and durations on this page are illustrative.

1. At a glance

Item	Answer
Mandate	Turn policy and obligations into tiered, testable controls early, then challenge the first line's evidence that they work
Primary decision	Each lens decides within its own authority: approve, approve with conditions, decline, or require an exception with a compensating control
First safe win	AI drafts a first-pass obligation map for a use case from approved policy sources, with a citation per line; the reviewer confirms each citation
Biggest failure mode	A single combined "risk approval" at the end, after the build, that nobody can trace back to who decided what

Line: 2nd line · Family: Govern · Variants: AI / model risk, privacy, legal, compliance, records, TPRM (third-party risk management)

Role variants: six lenses, six questions

Lens	The question it answers	Its artifact	Its authority
AI / model risk	Is this a model under policy? What tier? Is validation needed, and are limits and monitoring adequate?	Tier confirmation, model risk assessment, conditions of use	Confirms tier and material-change outcomes; routes to independent validation, which produces the validation report. Its own risk decision is a separate artifact; the use-case owner or policy-named authority accepts or approves the use subject to recorded restrictions and residual risk
Privacy	Is personal data used for a stated purpose, minimized, protected and kept only as long as allowed?	PIA (privacy impact assessment), data-flow diagram	Approves or conditions personal-data use
Legal	Are contract terms, IP (intellectual property), liability and output rights acceptable?	Legal opinion or contract review note	Advises; approves contract terms where policy says so
Compliance	Do disclosures, customer communications and conduct meet applicable obligations?	Obligation map, wording approval	Approves regulated wording and conduct controls
Records	Which prompts, outputs and traces are business records? What schedule and hold apply?	Records classification and retention decision	Decides record status and schedule
Third-party risk	Is the provider acceptable: data terms, sub-processors, model change notice, exit plan?	Vendor assessment, contract conditions	Approves or conditions the vendor relationship

Different lenses, different decisions. A privacy approval says nothing about vendor terms, and a compliance wording approval says nothing about model validation.

2. Your journey: first steps to fully adopted

Risk and compliance moves from AI-drafted obligation maps with citations to continuous control monitoring; every tier, approval and exception stays a human decision.

Start here: your first steps

Publish the risk tiers and the controls each tier requires, so teams know at intake what evidence they owe.
Add every AI use case to the AI inventory with its tier, its owner and the lenses it needs.
Use an approved tool to summarize a long policy or PIA (privacy impact assessment), inside confidentiality rules.
Draft an obligation map from a versioned index of approved policy, with a citation per line that the reviewer checks.

Fully adopted: how the work runs

Moment in the work	Before AI	Fully adopted (Stage 4–5)	Decision that stays human
Intake	Teams arrive after the build and ask for one combined sign-off	The intake card in the AI inventory arrives with a proposed tier and the lenses it needs, each with a reason	Tier confirmation, by AI / model risk
Assessment	Each lens starts from a blank page	Each lens receives a checked draft: obligation map, PIA first pass or contract comparison, with citations and a gap list	Each lens's approval, conditions or decline
Exceptions	Exceptions expire silently in a spreadsheet	A workflow tracks every exception and review date and alerts before expiry; it cannot extend or close one	Granting or renewing an exception
Monitoring	Controls are sampled once a year	Continuous control monitoring reads first-line evidence and flags gaps as they appear	Whether the evidence is sufficient
Material change	A new model or a wider reach is found at the next annual review	Change records and a policy change scan trigger reassessment when reach, data or actions grow	Re-triage, and any move to High

What changes for the organization

Before	After
One late, combined risk sign-off nobody can trace	Separate lens decisions made early, each traceable to who decided what
Controls written as policy text	Tiered, testable controls with evidence someone else can check
Reviews driven by the calendar	Reviews triggered by evidence and material change

In any organization

Small or unregulated: a product or engineering lead, with outside legal advice, covers the lenses; privacy and vendor checks still happen for personal data and providers.
What scales down: the number of lenses, committees and review frequency shrink. A risk tier per use case, a named approver for every exception, and a recorded decision before AI output reaches customers never do.

3. Your decisions

Decision	You own, advise or challenge	Inputs	Escalation	Cannot be delegated
Risk tier confirmation	AI / model risk owns, with the AI governance function	Intake card, data classes, actions, customer reach	Risk committee for disputed High or Prohibited	Yes
Required controls and evidence per tier	Each lens owns its own controls	Policy, the control crosswalk	Head of the lens	Yes
Personal-data use	Privacy owns	PIA, data-flow diagram, masking tests	Chief privacy officer or equivalent	Yes
Provider acceptance	Third-party risk owns, legal advises	Vendor assessment, contract terms, exit plan	Procurement and the business owner	Yes
Customer wording and disclosures	Compliance owns	Draft text, the change record	Legal	Yes
Record status and retention	Records owns	Records classification request	Legal for holds	Yes
Exceptions	Each lens approves deviations from its own control	Gap, reason, compensating control, expiry	Lens head; renewals by the same approvers	Yes
First-line evidence is sufficient	Challenge	Evaluation results, test evidence, monitoring	Business owner, then the risk committee	Yes

4. Two kinds of adoption

Kind	What it means for risk and compliance	Example
How you work with AI	AI drafts obligation maps, compares a vendor contract to the standard terms, summarizes a long PIA, and finds which policies apply. Only from approved sources, with citations, inside confidentiality rules. You make the judgment and record it	AI lists which policy sections apply to showing a cutoff time to customers, each with a link; the compliance reviewer checks every link and adds one it missed
What you govern that contains AI	Every AI use case in the inventory: its tier, controls, exceptions, monitoring and periodic review	The internal policy assistant: medium tier, citation and abstention controls, staff verification duty, yearly review

Tiered, testable controls are the core output. A control is testable when someone else can check it with evidence.

Tier	Example control	How it is tested	Evidence
Low	Tool is on the approved list; acceptable use attested	Inventory lookup; attestation record	Approved-tool register, attestation
Medium	Data classification check before data enters prompts; evaluation set with thresholds; reviewer on every output	Masking test; evaluation run; sampled review records	Test results, evaluation report, review log
High	PIA approved; independent validation; monitoring with thresholds; tested kill switch; periodic review twice a year (illustrative)	Validator re-runs results; kill-switch rehearsal; monitor alert test	Validation report, rehearsal record, alert record
Prohibited	Fully automated adverse customer decisions are blocked	Intake rule; design review; monitoring for drift into the use	Intake decision, design note

AI output that reaches a customer directly or drives a customer outcome is High in this site's running examples. Other uses may also be High under the organization's policy, data sensitivity, action scope and jurisdiction. A use case moves up a tier when its reach or its actions grow; see governance first.

5. Your ladder

Stage	AI use	Guardrail	Artifact or evidence	Decision relationship	Step-down trigger
0 · Foundations	None. You publish the tiers, acceptable use, data classification rules and the control crosswalk	Each lens names its controls and evidence	Published standards; intake triage rules	Owner of the standards	Not applicable yet
1 · Personal productivity	AI explains a public standard or drafts a plain-language summary of your own policy. No confidential case data in prompts	Approved tool; confidentiality rules; you rewrite	Your own drafts	Owner of every judgment	Confidential material in an unapproved tool
2 · Team context	AI searches the approved policy library and past decisions through a read-only index; answers with citations	Approved sources only; index versioned and owned	Draft obligation maps with citations	Owner; the lens head is consulted on new interpretations	Citations that point to withdrawn policy
3 · Delegated tasks	An agent drafts the obligation map, the PIA first pass or a contract comparison, and flags gaps	Evaluation set of past reviews with known issues; trace kept; output is a draft	Draft review with a gap list	Owner and approver; agent output is input only	The agent misses known issues; reviewers accept drafts unedited
4 · Agentic workflows	A workflow pulls intake data, checks evidence links, and tracks exceptions and review dates across the inventory	Read access to the inventory; no permission to approve, close or extend an exception	Evidence status reports; expiry alerts	Owner of each decision; first line is evidence provider	Any change to an approval or exception made by the workflow
5 · Scale and sustain	Shared, evaluated review assistants per lens; continuous control monitoring	Asset owners; periodic review; material-change process for the assistants	Catalog entries; control monitoring trend	You remain the decision owner	A model or provider change for the review assistant

Stays human at Stage 5: tier confirmation, every approval and exception, compliance judgment, and the decision that evidence is sufficient. An assistant can find the policy. It cannot decide what the policy means for this case. Step down after a model change, a failed evaluation, an incident or a material change; see the adoption ladder.

6. Priority scenarios

Scenario	Value	Risk tier	Stage	First step	Do not use AI when…
Obligation map from approved policy	Faster, earlier control requirements	Medium	2	Build a versioned index of approved policy only	The policy source is not approved or not current
PIA first pass	Privacy reviewers start from a structured draft	Medium	3	Template with data classes, purpose, flows, retention	The data flow is not yet known; ask the team first
Contract comparison to standard terms	Quicker vendor reviews	Medium	3	Approved standard terms as the baseline	The contract is under negotiation with privileged advice in the text, unless legal approves the tool
Exception and review-date tracking	No silently expired exceptions	Low to medium	4	Read-only feed from the inventory	The tracker would extend an exception on its own
Regulatory and policy change scan	Reassessment triggered on time	Medium	3	Approved sources list; human triage of each finding	A finding would change a tier without review
Drafting a conclusion or approval	None worth the risk	High	Never	Write it yourself	Always: the conclusion is the decision

7. The due-date ask from your seat

The due-date change has material decisions for several lenses, so it gets the full narrative. The AI use (a coding agent that drafts code, tests and notes) is medium tier: no AI output reaches a customer. The display change itself is customer-facing and goes through normal change control.

Lens	Decision	Input received	Output and evidence	Recipient
AI / model risk	Confirms medium tier for the coding agent; no independent validation required	Intake card; tool on the approved list	Tier confirmation in the inventory	AI governance function
Privacy	The time-zone preference from profile-service is personal data; using it to format the cutoff fits the stated purpose; no new PIA, the existing one is updated	Data-flow note: zone read, not stored	PIA update	Privacy register
Compliance	Approves the customer wording for the cutoff and the fallback label; confirms the due date stays the contractual date	Release-note draft; fallback text	Wording approval	Change record
Records	Issued statements are immutable; the change applies from the next cycle; agent traces kept under the engineering schedule	Change record	Records note	Records register
Legal	Not consulted: no contract or IP question beyond the approved tool terms	Intake card	Note in the inventory: "not required"	Inventory
Third-party risk	No change: the coding assistant's vendor assessment is current	Vendor register	Confirmation	Inventory

A negative path tests the lenses. A team later proposes letting an assistant write the reminder text sent to each customer. That AI output would reach customers directly, so the use moves to High. AI / model risk re-triages it; privacy, compliance and independent validation are now required.

8. Hand-offs and separation of duties

You give → to whom	You receive ← from whom	You challenge	You are notified of
Tier and required controls → business owner, product owner	Intake card ← product owner	A tier set low to avoid review	Material changes, from the release manager
Approval or conditions per lens → AI inventory	Evaluation and test evidence ← QA (quality assurance) engineer, AI engineer	Evidence that tests only the happy path	Incidents and near misses, from production support
Wording approval → release manager	Threat model ← security	"Not a model" claims with no reasoning	Provider and model change notices
Exception decisions → business owner, inventory	Validation report ← independent validation (the use-case owner or policy-named authority accepts or approves the use; any AI / model risk decision is a separate artifact)	Exceptions renewed with no progress	Complaints and override trends, from business operations
Evidence index → internal audit	Audit findings ← internal audit	Nothing: audit challenges you, not the other way	Audit plan and sample requests

Separation of duties: the second line sets and challenges controls; it does not build the system or own its risk. A lens never approves a control it designed and also operates. The first line owns the risk and produces the evidence.

Third-line interface: internal audit

Internal audit is not part of risk and compliance. It is the third line, independent of both other lines.

Internal audit…	What it means in practice
Receives evidence	The AI inventory, intake and tier decisions, control design, validation reports, change records, monitoring, exceptions and incidents
Assesses independently	Tests whether governance and controls work as designed and as operated, by sampling evidence chains from either end
Reports findings	To the audit committee or equivalent; management owns the response and the fix
Never approves releases	It does not sign first-line changes or second-line approvals
Never designs controls	It may comment on design; it does not build the control it will later test

9. Evidence and records

Evidence produced or consumed	System of record	Retention owner
Tier decision and required controls	AI inventory	AI governance function
Approvals and conditions, per lens	AI inventory, linked to each lens's register	Each lens
PIA and data-flow diagram	Privacy register	Privacy office
Vendor assessment and contract conditions	Third-party risk register	Third-party risk
Records classification and retention decision	Records register	Records management
Exceptions with expiry	AI inventory	Business owner; approving lens
AI-assisted review drafts	Lens case file, marked AI-drafted, sources listed, reviewer named	Each lens
Audit findings	Internal audit's system	Internal audit

See the evidence system of record.

10. Skills and learning path

Level	You can…	Labs and practice
Foundation	Read an intake card and assign a tier; tell a model from a tool under your policy	Lab L6 (policy assistant: see citation and abstention)
Practitioner	Write a testable control and its evidence; challenge an evaluation report by risk slice	Lab L4 (evaluation sets) and Lab L5 (approval gates)
Advanced	Run a tabletop on a material change; set reassessment triggers for policy change	Lab L2 (reusable prompt with approved sources)

Decision literacy matters more than prompting. Practise scenarios (illustrative: one a month): a silent model swap, a corpus with a withdrawn policy, a use case that drifts into customer reach.

11. Measures and incentives

Metric	Definition	Anti-gaming note
Time to tier	Intake to tier decision, by tier	Fast and wrong is worse than slow; sample decisions for quality
Controls defined before build	Share of use cases with controls set before the first build	Count only controls with named evidence
Expired exceptions	Exceptions past expiry and still in use	Renewals with no progress count as a finding, not a fix
Reassessments on time	Periodic reviews and material-change reviews done by their date	A review with no evidence read does not count
Audit findings on AI controls	Findings per audit cycle, by severity	Do not reward zero findings; reward findings closed with evidence

12. Cost, capacity and workforce

Item	What to plan
Capacity	Early intake triage saves late rework; staff each lens for the intake volume, not only for final reviews
Cost	AI-assisted review tools need their own evaluation and owner; fund them as assets
Workforce	Reviewers move from searching to judging. Train decision literacy on AI failure modes

13. Anti-patterns and stop conditions

Anti-pattern	Why it hurts	Stop condition
Omnibus risk sign-off	Nobody can say who decided what	Any approval that does not name its lens and authority: reject it
Review at the end	Controls bolted on after build cost the most	Use case at build with no tier: pause until triage
AI-drafted conclusion	The judgment is outsourced to a tool	A conclusion with no named human author: void it
Unapproved sources	Advice based on stale or unofficial text	Review assistant citing a non-approved source: disable until fixed
Exceptions that never end	The compensating control becomes permanent	Third renewal with no progress: escalate to the lens head
Audit drawn into design	Independence is lost	Internal audit asked to approve a release or design a control: decline the request

14. Action kit and 30/60/90

LENS DECISION CARD (one per lens, per use case)
Use case and inventory id:
Lens: AI / model risk, privacy, legal, compliance, records, or third-party risk
Question this lens answered:
Decision: approve / approve with conditions / decline / exception
Conditions and the evidence that will show them met:
Sources used (approved, versioned), with citations:
AI assistance used? Tool, what it drafted, who verified:
Reassessment triggers: model or provider change, new data, wider reach, new tools
Decided by (name of role), date, expiry or next review:

Questions to ask your enablement lead:

Which approved policy sources are indexed for review assistants, and who owns that index?
Does our intake card capture customer reach and actions, so the tier is clear on day one?
Where do lens decisions live, so internal audit can find them from the inventory?

Window	Goal	Done when
30 days	Separate the lenses	Each lens has its question, artifact and authority published; the decision card is in use
60 days	Make controls testable	Every tier has controls with named evidence; the crosswalk is linked from intake
90 days	Assist safely	One review assistant on approved sources with an evaluation set; reassessment triggers live in the inventory

Related: governance first for tiers and the control crosswalk, operating model for decision rights, templates for the risk-tier checklist.