Introduction

You will learn to recognize situations where AI assistance is no longer appropriate--where AI must stop and human expertise is required--and to escalate appropriately without hesitation.

At the Assisted Use level, you are moving from understanding concepts to applying them with guidance. You will begin using AI tools under supervision, learning to evaluate their outputs critically and document your verification processes. This is where theory meets practice -- with appropriate guardrails in place.

This lesson is designed to be accessible to professionals at all experience levels while providing the depth needed for practical application. Whether you are encountering these concepts for the first time or building on existing knowledge, the material ahead will strengthen your ability to navigate AI governance challenges with confidence and competence.

Core Concepts

Anti-Patterns / Misuse Risks

Anti-Pattern 1: Using AI When Uncertain About Accuracy "I'm not sure if AI got this right, but I'll use it anyway and hope no one questions it."

Risk: If you're uncertain, you're exposing the organization to risk. Professional responsibility requires escalating uncertainty.

Safeguard: If you're uncertain about accuracy, escalate for verification before using.

Anti-Pattern 2: Avoiding Escalation Due to Time Pressure "This decision is urgent, so I'll use AI's answer instead of waiting for legal review."

Risk: Urgency doesn't eliminate the need for appropriate expertise. Bad decisions made quickly are still bad.

Safeguard: Escalate for expedited review if urgent, but don't skip expertise.

Anti-Pattern 3: Over-Relying on AI for Complex Judgment "AI gave me an answer, so I'll trust AI's judgment instead of using my own expertise."

Risk: You're a professional; trust your judgment. AI is a tool to assist, not to replace.

Safeguard: If your judgment differs from AI's output, investigate the discrepancy. Don't blindly follow AI.

Anti-Pattern 4: Hiding Decisions That Should Be Escalated "I made this decision using AI, but I won't mention the AI piece because leadership might question it."

Risk: Hiding your process undermines transparency and trust. It suggests you know you should have escalated.

Safeguard: Be transparent about AI use. If you're hiding it, you probably should have escalated.

Anti-Pattern 5: Assuming Policy Exemptions "The policy says medium-risk uses need approval, but this seems more important, so surely it should be approved. I'll do it and ask forgiveness later."

Risk: "Surely" is not permission. You're violating policy and hoping for retroactive forgiveness.

Safeguard: Ask for approval before proceeding, not after.

Human Judgment Checkpoints

Before proceeding with AI-assisted work, ask yourself:

• Confidence Check: Am I confident in AI's output? If not, escalate.
• Expertise Check: Does this decision require expertise I don't have? If so, escalate.
• Legal/Regulatory Check: Does this have legal or regulatory implications? If so, escalate to legal/compliance.
• Data Check: Am I handling restricted or sensitive data appropriately? If unsure, escalate.
• Policy Check: Does my use of AI comply with organizational policy? If unsure, escalate.
• Material Impact Check: Would getting this wrong cause significant harm? If so, escalate for verification.
• Ownership Check: Should someone else own this decision? If so, involve them.
• Transparency Check: Would I be comfortable explaining this decision to my boss, an auditor, or a regulator?

[Practical Tip]

As you work through these concepts, consider how each one applies to your current role. Think of a specific scenario from your recent work where this concept would have been relevant. Building these mental connections between theory and practice is the fastest way to internalize new knowledge and make it actionable in your daily responsibilities.

Traceability / Defensibility Considerations

Escalation creates accountability:

What to Record: - What issue required escalation - Who you escalated to and when - What guidance you received - How you followed the guidance - Final decision or approval

Why This Matters: - Shows you recognized limitations and acted appropriately - Demonstrates professional judgment and risk awareness - Provides documentation that appropriate experts were consulted - Protects the organization by ensuring expertise was applied

Responsible AI and Control Considerations

Responsible Escalation Practices: 1. Humility: Recognize when you need help; escalate without defensiveness 2. Timeliness: Escalate early, not after decisions are made 3. Clarity: Clearly explain what requires escalation and why 4. Documentation: Record escalations and resulting guidance 5. Follow-through: Implement the guidance you receive

Control Considerations: - Escalation should be part of your control environment - Leaders should be accessible for escalation questions - Escalation should not be penalized; it's a sign of good judgment - Organizational culture should encourage escalation when uncertain

[Practical Tip]

As you work through these concepts, consider how each one applies to your current role. Think of a specific scenario from your recent work where this concept would have been relevant. Building these mental connections between theory and practice is the fastest way to internalize new knowledge and make it actionable in your daily responsibilities.

Practice / Reflection Prompts

• Identify escalation triggers. Based on your role, what situations would trigger an escalation for you? List 3-5 red flags that would make you stop and ask for help.
• Recall past escalations. When have you escalated a decision or issue? Was the escalation appropriate? What did you learn?
• Write escalation emails. Draft three escalation emails for hypothetical situations: one for legal review, one for policy guidance, one for expert verification. Review them with a mentor.
• Role-play escalation conversations. Practice asking your boss or a colleague for guidance on whether something requires escalation. Get comfortable with the phrasing and approach.
• Establish escalation criteria. Create a personal checklist of when you escalate. Review it with your manager to ensure alignment on escalation thresholds.

Practical Application

Understanding concepts in the abstract is valuable, but the real test is whether you can apply them in professional practice. This section bridges the gap between theory and application with concrete scenarios drawn from oversight work.

Use Case 1: Recognizing When Legal Interpretation Is Needed You're working on a new data privacy procedure. You used AI to draft requirements based on GDPR. But you're uncertain whether your interpretation of consent requirements is correct. The policy will apply to customer data.

Escalation needed? - YES. Legal interpretation of regulations is beyond AI's scope. - Action: Send draft to Legal Counsel. Request: "Please review the consent requirements in Section 3 and confirm that our interpretation is correct. I drafted this with AI assistance, but I want legal confirmation before we implement it."

Use Case 2: Recognizing Material Risk Implications You synthesized audit findings. AI flagged a control area as "high risk" because findings appear in multiple audits. But you want to verify that this risk assessment is sound before presenting to the risk committee, because it may trigger material remediation spending.

Escalation needed? - YES. Material risk assessments should be reviewed by risk experts. - Action: Schedule a meeting with your audit lead and risk officer. Present the AI synthesis and say: "I want to validate this risk assessment before presenting to the risk committee. Does the pattern of findings support a 'high risk' conclusion?"

Use Case 3: Recognizing Restricted Data Issues You want to analyze employee termination data to identify trends in involuntary separations by department. You think AI could help identify patterns. But the data includes employee names, termination reasons, and performance ratings.

Escalation needed? - YES. Employee data is restricted; sharing it with AI may violate policy and privacy expectations. - Action: Escalate to HR and Compliance. Ask: "I want to analyze termination trends by department. The analysis would require sharing employee names and performance data. Can this be de-identified or handled differently to comply with privacy policy?"

Use Case 4: Recognizing Policy Violation Risk You want to use AI to draft a control procedure for a sensitive operational process. But the AI use policy requires that control procedures be drafted by process owners or reviewed by process subject matter experts.

Escalation needed? - YES. Using AI alone for control procedures violates policy; you need subject matter expert involvement. - Action: Propose a collaboration: AI drafts a first pass, then the process owner reviews and refines it. Document that the process owner (not just you) approved the final procedure.

Detailed Examples

The following examples illustrate how the concepts from this lesson play out in real-world oversight scenarios. Each example is designed to help you recognize similar situations in your own work and respond with appropriate professional judgment.

Example 1: Escalation Email - Legal Interpretation

Situation: You drafted a data privacy policy using AI. The encryption requirements seem clear, but when you read closely, you're not sure whether the policy's exemption for "system recovery" is consistent with GDPR Article 32 (which requires encryption in almost all cases).

Escalation Email: ``` To: General Counsel Subject: Data Privacy Policy Legal Review Request

I've drafted a data privacy policy with AI assistance (attached: draft_policy_v3.docx).

Specific concern requiring legal review: The policy includes a "system recovery" exemption to encryption requirements (Section 4.3). I want to confirm that this exemption is legally defensible under GDPR Article 32, which seems to require encryption in most contexts.

Question for you: Does our system recovery process align with GDPR's permitted exceptions to encryption, or do we need to modify the exemption language?

I'll schedule time on your calendar to discuss.

Thanks, [Your name] ```

Example 2: Escalation Conversation - Material Risk Assessment

Situation: You synthesized audit findings and AI flagged three control areas as "high risk" based on repeat findings. But you want expert validation of the risk assessment before proposing material remediation spending.

Conversation with Audit Lead: ``` You: "I've synthesized findings from three years of audits. I want to validate the risk assessment before presenting to the risk committee. Can we schedule 30 minutes to review?"

Audit Lead: "Sure. What's the concern?"

You: "AI analysis showed repeat findings in Access Controls, Change Management, and Data Governance. I labeled those as 'high risk' because findings appeared in multiple audit years. But I want to confirm: Does the pattern justify a 'high risk' rating? Or are some of these findings different iterations of the same underlying issue?"

Audit Lead: "Good question. Let me review the original reports alongside your synthesis. I'll confirm the categorization."

[After review]

Audit Lead: "I see what you mean. The Access Control findings are truly repeat (same issue, 2023 and 2025). But the Change Management findings are different in each year (different control gaps). I'd rate those as 'medium risk' not 'high risk.' The Data Governance issues are mostly resolved. Let me refine the risk assessment."

You: "That's exactly the validation I needed. Let me update the synthesis with your corrections and send you the revised version for approval before I present to the risk committee." ```

This escalation led to more accurate risk assessment.

Example 3: Escalation Email - Restricted Data

Situation: You want to analyze patterns in customer complaints to identify product defects. The complaints contain customer names, account numbers, and sometimes sensitive details. You think AI could help categorize them, but the data is restricted.

Escalation Email: ``` To: Chief Compliance Officer, Privacy Officer Subject: Data Analysis Approach - Customer Complaint Trends

I'm analyzing customer complaints to identify product defect trends. I'd like to use AI to help categorize and identify patterns.

Concern: The complaints contain customer personal data (names, account numbers) and sensitive details. I want to confirm the right approach:

Option A: De-identify the complaint data first (remove customer identifiers), then use AI on de-identified data Option B: Obtain explicit policy exception to share identified customer data with the AI system Option C: Analyze manually without AI assistance (slower but safest)

Question: Which approach is preferred per our data privacy policy?

I'll wait for your guidance before proceeding.

Thanks, [Your name] ```

Likely response: De-identification (Option A) would be approved, allowing AI use with appropriate safeguards.

Example 4: Escalation Conversation - Process Owner Involvement

Situation: You want to draft a procedure for vendor payment approval using AI. But the AI use policy requires that control procedures involve process subject matter experts (process owners).

Conversation with Finance Manager (Process Owner): ``` You: "I'd like to improve our vendor payment approval procedure. I was thinking of using AI to help draft it, but I want to involve you directly per our AI use policy."

Finance Manager: "How would you use AI?"

You: "I'd have AI create a first draft based on best practices for payment controls. Then you'd review it, refine it based on our actual process, and approve the final version. That way AI assists with the structure and language, but you ensure it reflects our actual operations."

Finance Manager: "That works. Let me give you an overview of how payments are actually approved in our process, and then AI can draft based on that."

[You gather details from Finance Manager]

[AI drafts procedure based on Finance Manager's description]

Finance Manager: "This draft is pretty good. Let me refine a few steps to match our system's capabilities, then I'll sign off."

[Final procedure is approved with Finance Manager's signature and your documentation showing their approval] ```

This approach ensures process ownership while leveraging AI for drafting efficiency.

Putting It Into Practice

At the Assisted Use level, implementation means beginning to incorporate these concepts into your supervised AI work:

• Practice with guidance: Use AI tools for low-stakes tasks with a mentor or supervisor available for review. Build confidence gradually before taking on more complex scenarios.
• Verify systematically: Develop a personal checklist for reviewing AI outputs. Even a simple three-point check (accuracy, completeness, appropriateness) dramatically improves output quality.
• Document your process: Record what AI tool you used, what prompt or input you provided, what output you received, and what verification steps you performed. This documentation habit is essential.
• Seek feedback: Share your AI-assisted work products with experienced colleagues. Their input helps calibrate your judgment about when AI outputs are reliable and when they require additional scrutiny.

Key Takeaways

Review the core concepts from this lesson and consider how each one applies to your professional practice.

As you continue through this credential program, you will build on the foundation established in this lesson. Each subsequent lesson adds new dimensions to your understanding and expands your capability to work effectively with AI in oversight roles.