Introduction

You will learn how to use AI as a research partner to gather information, synthesize findings from multiple sources, and verify that AI's research is accurate, relevant, and traceable--so that work based on that research is defensible.

At the Assisted Use level, you are moving from understanding concepts to applying them with guidance. You will begin using AI tools under supervision, learning to evaluate their outputs critically and document your verification processes. This is where theory meets practice -- with appropriate guardrails in place.

This lesson is designed to be accessible to professionals at all experience levels while providing the depth needed for practical application. Whether you are encountering these concepts for the first time or building on existing knowledge, the material ahead will strengthen your ability to navigate AI governance challenges with confidence and competence.

Core Concepts

Anti-Patterns / Misuse Risks

Anti-Pattern 1: Citation Without Verification "AI said the NIST framework requires quarterly access reviews. I'm including that in my control procedure without checking NIST."

Risk: AI may misremember or misstate the requirement. Your control procedure may be too stringent (or too lenient), and you can't defend it because you never verified the source.

Safeguard: Always verify any factual claim against the source AI cites. If you cite a framework, you've implicitly verified the claim.

Anti-Pattern 2: Relying on AI's Knowledge Cutoff "AI told me what the latest cybersecurity threats are. That's current enough for my risk assessment."

Risk: AI's training data has a cutoff date; recent threats, guidance, or incidents may be outside its knowledge. You may miss material risks or emerging regulations.

Safeguard: For time-sensitive topics (recent regulations, emerging threats), verify that AI's information is current by checking recent agency websites, news, or reports.

Anti-Pattern 3: Accepting AI Synthesis Without Source Checking "AI synthesized 10 sources into a neat framework. It looks good, so I'm using it as our policy foundation."

Risk: AI may have misinterpreted sources, conflated different ideas, or invented connections that don't exist. Your policy is built on a misunderstanding.

Safeguard: Spot-check AI's synthesis against at least a few of the source documents. Verify that key claims are traceable to cited sources.

Anti-Pattern 4: Treating AI as a Source "My risk brief cites AI research, so I'm confident it's accurate."

Risk: AI is not a source; it's a research tool. Citing "AI said" in a professional document raises credibility questions. You should cite the underlying sources.

Safeguard: Always trace research back to primary sources. Cite the source, not the AI tool.

Anti-Pattern 5: Ignoring AI's Uncertainty "AI said it couldn't find recent guidance on that topic. I'll assume there isn't any."

Risk: AI's inability to find something doesn't mean it doesn't exist. AI may lack knowledge, or you may have phrased the question unclearly.

Safeguard: If a topic matters for compliance, don't rely on AI's silence. Do a direct search (regulatory website, search engine, advisory service) to confirm.

Human Judgment Checkpoints

Before using AI research in professional work, ask yourself:

• Source Verification Check: Have I confirmed that each cited source exists and contains the information AI attributed to it?
• Currency Check: Is the research current for the topic? For time-sensitive matters (regulations, threats), have I verified information is not outdated?
• Completeness Check: Has AI captured the full landscape, or are there obvious gaps? (Direct agency website review is a good gap-check.)
• Interpretation Check: Where AI interpreted or synthesized sources, have I verified the interpretation matches the original?
• Authority Check: Are sources authoritative for my use case? (For compliance research, primary sources like regulations or agency guidance are most credible.)
• Citation Discipline Check: Are sources properly cited in my final work? Am I attributing claims to the source, not to AI?
• Professional Standard Check: Would a peer or auditor accept these sources and verification steps as sufficient for the decision or recommendation I'm making?

[Practical Tip]

As you work through these concepts, consider how each one applies to your current role. Think of a specific scenario from your recent work where this concept would have been relevant. Building these mental connections between theory and practice is the fastest way to internalize new knowledge and make it actionable in your daily responsibilities.

Traceability / Defensibility Considerations

Research supports decisions. If your decision is later questioned, you need to show your research was sound:

What to Record: - Research question or scope (what were you trying to find?) - AI tool and instructions used (what did you ask AI to do?) - AI's initial response or recommendations - Sources AI cited - Verification steps taken (which sources were checked, by whom, when) - Discrepancies found between AI response and verified sources - Final sources used and how they were cited in your work - Who reviewed the research and approved its use

Why This Matters: - An auditor asks: "How did you conclude that we need to implement quarterly access reviews?" - Your answer: "We researched industry frameworks. AI identified NIST and COSO as relevant; we verified both frameworks. NIST guidance specifies at least annual access reviews; COSO emphasizes periodic reviews. We selected quarterly as a more stringent control for our risk profile. [Cite frameworks, show verification work.]" - Without documentation: "I just used AI research" provides no assurance of rigor.

Example Research Log: ``` RESEARCH LOG: Third-Party Risk Management Guidance Date: 2026-03-08 Research Question: What third-party risk management guidance has been issued by U.S. banking regulators in the past 12 months? AI Tool Used: Claude (Compliance Portal) AI Prompt: "Provide a list of third-party risk management guidance from Federal Reserve, OCC, FDIC in the past 12 months..." AI Response: [List of guidance items] Verification: - Fed.gov: Searched "third-party risk management" -> Found [Guidance A], [Guidance B] - OCC.gov: Searched "third-party risk" -> Found [Guidance C], [Guidance D] - FDIC.gov: Searched "third-party" -> Found [Guidance E], [Guidance F], [Guidance G - NOT mentioned by AI] Discrepancy Found: FDIC Guidance G (Bulletin on Third-Party Cybersecurity) was not mentioned by AI Result: AI captured 80% of relevant guidance; direct agency search identified 1 additional item Verification Done By: Jane Smith, Compliance Analyst Review and Approval: Robert Chen, Chief Compliance Officer Use: Cited in Compliance Brief dated 2026-03-10 ```

Responsible AI and Control Considerations

Responsible Research Practices: 1. Transparency: Tell stakeholders that AI was used to accelerate research; show that sources were verified 2. Source discipline: Cite sources, not AI; hold yourself accountable for source accuracy 3. Verification rigor: Invest time in verification proportionate to the importance of the research 4. Gap awareness: Recognize that AI may miss recent information or niche topics; supplement with direct searches for material questions 5. Bias awareness: Be alert that AI may emphasize certain sources or perspectives; broaden your source base if needed

Control Considerations: - Ensure AI-assisted research complies with your organization's information security and retention policies - If researching sensitive topics (competitors, vulnerabilities), verify the AI tool is appropriate for the sensitivity level - Maintain records of research work in accordance with audit and compliance record retention requirements - For material decisions based on research, ensure that verification and source review are documented

[Practical Tip]

As you work through these concepts, consider how each one applies to your current role. Think of a specific scenario from your recent work where this concept would have been relevant. Building these mental connections between theory and practice is the fastest way to internalize new knowledge and make it actionable in your daily responsibilities.

Practice / Reflection Prompts

• Choose a compliance topic relevant to your role. Use AI to research the topic, then spend 30 minutes verifying the AI response against primary sources. Document what you found, what AI missed, and what you would have done differently.
• Find a recent guidance document (regulatory, best practice, or organizational). Ask AI to summarize it, then compare AI's summary to your own reading of the source. Where did AI go astray? How would an unverified AI summary have misled you?
• Build a research log for your next AI-assisted research project. Record your question, AI's response, sources checked, verification results, and final usage. Show the log to a colleague and ask: "Does this documentation satisfy you that the research was rigorous?"
• Experiment with source evaluation: Find an AI claim about a "best practice" or "industry standard." Trace it back to original sources. Is the claim accurate? Is it universal, or does it depend on context?
• Challenge the gaps: After AI completes research on a topic, do a direct search (agency website, news, professional network) for the same topic. Did AI miss anything material? What triggers you to do independent research even after AI's response?

Practical Application

Understanding concepts in the abstract is valuable, but the real test is whether you can apply them in professional practice. This section bridges the gap between theory and application with concrete scenarios drawn from oversight work.

Use Case 1: Emerging Risk Research Your risk committee asks: "Are there new cybersecurity threats we should know about for financial institutions?" You have one week to provide a summary.

Process: 1. Ask AI: "What are the top cybersecurity threats facing financial institutions as of early 2026?" 2. AI responds with threats (e.g., AI-based fraud, supply chain compromises, quantum computing risks) 3. For each threat, ask AI: "What evidence supports this as a material risk? What agencies or sources are tracking this?" 4. Note the sources AI cites (e.g., CISA alerts, SEC guidance, FSOC reports) 5. Verify: Go to each cited source (CISA, SEC, FSOC websites) and confirm the information exists and matches AI's description 6. Synthesize: Based on verified sources, prepare a one-page risk summary for the committee 7. Document: Include citations to original sources, not to AI

Use Case 2: Control Benchmarking You're designing a new user access control. You want to understand what peer organizations typically implement.

Process: 1. Ask AI: "What are best practices for user access controls in financial services? What do frameworks like COSO, NIST, or ISO 27001 say?" 2. AI provides an overview of COSO internal control principles, NIST cybersecurity frameworks, ISO 27001 controls 3. Ask AI: "For each framework, what are the specific requirements around least privilege, segregation of duties, and access review?" 4. Verify: Review the actual framework documents or trusted summaries (from COSO, NIST, ISO websites) 5. Gap analysis: Compare your organization's current controls against verified framework requirements 6. Design decision: Use verified framework guidance to inform control design 7. Document: Reference the frameworks, not the AI; document which framework principles guided your design

Use Case 3: Regulatory Compliance Tracking Your compliance team needs to track recent regulatory guidance on a specific topic (e.g., third-party risk management). You want to build a brief on recent agency actions.

Process: 1. Ask AI: "What regulatory guidance has been issued in the past 12 months on third-party risk management by U.S. banking regulators?" 2. AI lists guidance from Fed, OCC, FDIC, and Consumer Financial Protection Bureau (CFPB) 3. For each item, ask AI: "What is the core requirement? Who does it apply to? What is the effective date?" 4. Verify: Visit each regulator's website (Fed.gov, OCC.gov, FDIC.gov, CFPB.gov) and confirm the guidance exists 5. Check sources: If AI cites specific language, search the actual guidance document for that language 6. Identify gaps: Are there guidance items AI missed? (Check regulator websites directly) 7. Compile brief: Create a table of guidance items with proper citations and effective dates 8. Document: Cite the regulatory sources, note that AI was used for initial gathering, and confirm that you verified each item

Detailed Examples

The following examples illustrate how the concepts from this lesson play out in real-world oversight scenarios. Each example is designed to help you recognize similar situations in your own work and respond with appropriate professional judgment.

Example 1: Emerging Risk Research

Your Request to AI: "What are the primary cybersecurity threats facing financial institutions in 2026? For each threat, cite specific sources (agencies, reports, or authoritative organizations) that are tracking or warning about this threat."

AI Response: "Key threats include: 1. AI-powered fraud and deepfake attacks (CISA alerts, FBI IC3 reports) 2. Supply chain compromises targeting financial software (SEC SAB comment, recent incidents) 3. Quantum computing threats to encryption (NIST post-quantum cryptography initiative) 4. Cloud infrastructure misconfigurations (Gartner reports, breach data)"

Your Verification Process: - Go to CISA.gov and search for recent alerts on AI-powered fraud - Check the FBI's Internet Crime Complaint Center (IC3) for fraud data - Review recent SEC Cybersecurity Rules and related guidance - Visit NIST.gov and review their post-quantum cryptography initiative - Spot-check Gartner's reports on cloud misconfigurations - Result: AI accurately identified major threats; sources check out - Additional: You discover CISA also lists a specific threat about 3CX software; AI missed it

Your Research Brief (with proper citations): "Based on recent agency warnings and authoritative sources, the following threats warrant board attention: (1) AI-powered fraud, per CISA alerts and FBI IC3 trends; (2) supply chain risks, per SEC Cybersecurity Rules; (3) quantum threats, per NIST initiative; (4) cloud misconfiguration, per industry reports. Additionally, CISA has issued alerts on supply chain risks specific to financial software (3CX example). Recommendation: IT leadership assess exposure to each threat area."

Documentation: "Researched emerging cybersecurity threats using AI for initial identification. Verified each threat against CISA, FBI, SEC, and NIST sources. Additional threat identified through direct CISA review. Brief prepared by [Name], verified by [IT Lead]."

Example 2: Control Benchmarking

Your Request to AI: "Summarize how COSO, NIST, and ISO 27001 address user access controls. For each framework, describe the core principle and give 2-3 specific control examples. Include where I can find this guidance."

AI Response: "COSO (Internal Control--Integrated Framework): Focus on segregation of duties and authorization. CISO Framework: Identify, Protect, Detect, Respond, Recover; Access Control is under 'Protect.' ISO 27001: A.9 addresses access control; requires principle of least privilege and regular access reviews."

Your Verification Process: - Download or access COSO Internal Control--Integrated Framework (available from COSO.org) - Review NIST Cybersecurity Framework documentation (NIST.gov) - Check ISO 27001 standard or trusted ISO summary - Spot-check AI's description of segregation of duties in COSO - Verify the A.9 reference in ISO 27001 - Result: AI description is accurate but generic; you now read the actual frameworks for detail

Your Control Design Document: "Access control design informed by: (1) COSO Internal Control--Integrated Framework, segregation of duties principle; (2) NIST Cybersecurity Framework, Protect function; (3) ISO 27001:2022, Section A.9. Specific controls selected from each framework reflect organizational risk profile. [Attach framework citations.]"

Documentation: "Benchmarked access controls against COSO, NIST, and ISO 27001 using AI research assistance. Verified framework descriptions against primary sources. Control design reflects established frameworks; aligned with industry best practices."

Example 3: Regulatory Guidance Tracking

Your Request to AI: "What guidance has the Federal Reserve, OCC, and FDIC issued in the past 12 months on third-party risk management? For each item, provide the title, the core requirement, and the effective date."

*AI Response:* |

-------- | ---------------- | ----------------- | ----------------- |

Fed | Third-Party Relationships | Due diligence, ongoing monitoring | Varies by bank size |

OCC | Third-Party Relationships | Risk assessment, contract terms | Varies |

FDIC | Third-Party Risk Management | Oversight, performance metrics | TBD |

Your Verification Process: - Visit Fed.gov/banking and search for third-party guidance issued in 2025-2026 - Visit OCC.gov and search for third-party guidance - Visit FDIC.gov and search for third-party risk management guidance - For each item AI listed, find the actual guidance document - Verify the core requirement matches what AI stated - Confirm effective dates by reading the guidance document - Identify any guidance items AI missed (e.g., recent FDIC bulletins) - Result: AI captured most items accurately; you added one missed FDIC bulletin and corrected an effective date

Your Compliance Brief: "Recent regulatory guidance on third-party risk management (compiled from Federal Reserve, OCC, FDIC sources, 2025-2026): 1. Federal Reserve Third-Party Relationships Guidance (Effective per institution type; see guidance for timeline) 2. OCC Third-Party Relationships Risk Management (Effective per institution type) 3. FDIC Third-Party Risk Management Guidance (Effective per guidance document) 4. FDIC Bulletin on Third-Party Cybersecurity [newly identified] (Effective [date])

Key Requirements Summary: All three agencies require risk assessment, due diligence, ongoing monitoring, and documented oversight of third-party relationships. Effective dates vary by institution size and guidance type. [Attach copies of guidance documents.]"

Documentation: "Compiled third-party risk management guidance using AI research assistance to identify relevant documents. Verified each guidance item by accessing primary regulatory sources (Fed.gov, OCC.gov, FDIC.gov). Identified one additional guidance item through direct agency website review. Compliance brief attached with citations."

Putting It Into Practice

At the Assisted Use level, implementation means beginning to incorporate these concepts into your supervised AI work:

• Practice with guidance: Use AI tools for low-stakes tasks with a mentor or supervisor available for review. Build confidence gradually before taking on more complex scenarios.
• Verify systematically: Develop a personal checklist for reviewing AI outputs. Even a simple three-point check (accuracy, completeness, appropriateness) dramatically improves output quality.
• Document your process: Record what AI tool you used, what prompt or input you provided, what output you received, and what verification steps you performed. This documentation habit is essential.
• Seek feedback: Share your AI-assisted work products with experienced colleagues. Their input helps calibrate your judgment about when AI outputs are reliable and when they require additional scrutiny.

Key Takeaways

Review the core concepts from this lesson and consider how each one applies to your professional practice.

As you continue through this credential program, you will build on the foundation established in this lesson. Each subsequent lesson adds new dimensions to your understanding and expands your capability to work effectively with AI in oversight roles.