Introduction

Learn specific control types and design patterns for different parts of the AI pipeline: data inputs, model processing, and outputs. This lesson translates framework principles into concrete controls.

At the Workflow Integration level, you are designing and implementing AI-enhanced processes across your function. You need to think systematically about how AI fits into existing workflows, what controls are necessary, and how to measure the effectiveness of AI-integrated processes at scale.

This lesson is designed to be accessible to professionals at all experience levels while providing the depth needed for practical application. Whether you are encountering these concepts for the first time or building on existing knowledge, the material ahead will strengthen your ability to navigate AI governance challenges with confidence and competence.

Core Concepts

Practical Use Cases

Use Case 1: Input Controls for AI-Enhanced Audit Testing

Audit team implements AI to flag unusual transactions in an IT system.

Input controls: 1. Completeness: Daily, IT operations team reconciles transaction counts in the log to the source system. If there are missing transactions, the AI run is delayed until the issue is resolved. Documentation: "Daily completeness reconciliation; date, counts, any issues found."

• Accuracy: Daily, a sample of transactions is validated. Random sample of 50 transactions is verified in source system to confirm values are correct (amounts, dates, user IDs match). Documented: "Daily accuracy check; 50 transactions verified; any discrepancies noted."
• Consistency: Weekly, data definitions are checked. Are all user IDs in the same format? Are all transaction dates in the same format? Any inconsistencies are noted and corrected before running AI. Documented: "Weekly format and definition check."
• Lineage: Data governance team maintains documentation of transaction log source (core IT system), extraction process (nightly automated job), and any transformations (e.g., "normalized user IDs by removing leading zeros"). Documented in data catalog.

Result: AI runs on high-quality, well-documented data. If auditors question the input data, the team can explain where it comes from and validate its accuracy.

Use Case 2: Processing Controls for AML AI Model

Compliance team uses AI to screen transactions for AML/CFT risks.

Processing controls:

• Model Documentation:
• - What it does: "The model analyzes customer transaction patterns to identify potential money laundering risk. It flags transactions that are unusual for the customer's profile or that match known indicators of suspicious activity."
• - Input data: "Customer transaction history (past 90 days), customer profile (geography, business type, expected transaction volume), transaction details (amount, destination, frequency)"
• - Approach: "Machine learning model trained on historical transactions tagged as suspicious or legitimate"
• - Accuracy: "On test data, model achieves 92% accuracy in identifying suspicious transactions; false positive rate is 8%"
• - Limitations: "Model is less accurate for new customers ( 0.8
• - Model uses these features: transaction amount (relative to customer average), destination country (risk level), transaction frequency, time of day
• - Documentation: Feature definitions, thresholds, any rule overrides (e.g., "transactions to certain known customer vendors are flagged as low risk regardless of amount")
• Access Control:
• - Data science team: Can develop and test models (in test environment)
• - AI governance committee: Approves model deployment and parameter changes
• - Operations team: Can run the model and troubleshoot operational issues (but cannot modify rules)
• - Compliance team: Uses model output; can override flags
• Monitoring:
• - Daily: Automated check that model ran successfully; alert if job failed
• - Weekly: Check that output volume is within normal range (e.g., if model flags only 1% of transactions when it normally flags 3%, investigate)
• - Monthly: Review performance metrics (SAR filing rate, false positive rate, processing time)
• - Documented: Monitoring dashboard; alert log

Result: Model is well-documented, validated, and monitored. If issues arise, they are detected quickly.

Use Case 3: Output Controls for AI-Enhanced Risk Assessment

Enterprise risk management team uses AI to summarize risk assessment responses and suggest risk ratings (see Chapter 1).

Output controls:

• Completeness and Timeliness:
• - AI should process all 200 risk assessments and produce a summary for each
• - Output should be available by Monday of each assessment cycle
• - Control: Daily check that all submissions have been processed; if not, investigate and resolve delays
• - Documented: Output log with processing dates and any issues
• Reasonableness:
• - AI should assign risk ratings that vary (not all low, not all high)
• - AI should identify some risks as new or escalating (not the same as prior year)
• - Control: Monthly review of rating distribution; if distribution is unusual, investigate
• - Documented: Metrics dashboard showing rating distribution and trend
• Review and Approval:
• - Risk team reviews all AI-suggested ratings
• - For each rating, risk analyst verifies the summary is accurate and rating is appropriate
• - Analyst can adjust rating if they disagree with AI suggestion
• - Control: Risk team sign-off on final ratings before they are reported
• - Documented: Risk register shows final ratings; any overrides are noted
• Explainability:
• - For each risk, the system shows:
• - AI's summary of the assessment
• - AI's suggested rating
• - Key factors that influenced the rating
• - Control: Staff can understand why AI made its suggestion; can challenge it if warranted
• - Documented: Summary is included in final risk register
• Override and Appeal:
• - Risk analyst can override AI rating with brief explanation (e.g., "Business context changed; AI model doesn't yet know about the restructuring")
• - Overrides are logged and periodically reviewed
• - Control: Feedback loop to improve AI model
• - Documented: Override log; quarterly review of overrides to identify patterns

Result: Risk ratings are AI-enhanced but human-reviewed. Traceability is clear. If auditors question a rating, the team can explain the AI's reasoning and the human's judgment.

Anti-patterns / Misuse Risks

Anti-Pattern 1: Weak Input Controls Assuming data is good without validation. Example: AI is fed transaction data without checking for completeness or accuracy.

Risk: Garbage in, garbage out; AI produces unreliable outputs.

Prevention: Implement preventive controls on data quality; validate before AI processing.

Anti-Pattern 2: Black-Box Model Using an AI model without understanding how it works or what it does. Example: Buying a third-party AI tool; deploying it without reading documentation or testing it.

Risk: Model may be biased or make errors; organization cannot explain or defend its use.

Prevention: Require model documentation; validate before deployment; understand capabilities and limitations.

Anti-Pattern 3: No Output Review Assuming outputs are correct without human review. Example: Using AI risk scores without verification.

Risk: Errors or biases in AI propagate downstream; decisions are made on bad data.

Prevention: Implement detective controls (review outputs); ensure humans exercise judgment.

Anti-Pattern 4: No Feedback Loop Using AI but not tracking whether it's working. Example: Deploying AI; not monitoring whether it's accurate or biased.

Risk: Poor performance is not detected; problems compound over time.

Prevention: Implement monitoring; track accuracy metrics; use feedback to improve.

[Practical Tip]

As you work through these concepts, consider how each one applies to your current role. Think of a specific scenario from your recent work where this concept would have been relevant. Building these mental connections between theory and practice is the fastest way to internalize new knowledge and make it actionable in your daily responsibilities.

Human Judgment Checkpoints

Checkpoint 1: Input Validation Do you have processes in place to validate data quality before it goes into AI? Is validation actually happening?

Checkpoint 2: Model Understanding Can you explain how your AI model works? What are its limitations? If you can't, you need better documentation.

Checkpoint 3: Output Review Is someone actually reviewing AI outputs, or are they being used blindly? If it's the latter, you need a human control.

Checkpoint 4: Performance Monitoring Do you know if your AI is working as intended? Are you monitoring accuracy, bias, drift? If not, you should be.

Traceability / Defensibility Considerations

Documentation Trail - Keep documentation of input validation, model validation, output approvals - Log all monitoring results, exceptions, and corrective actions - If questioned by auditors, this trail shows you have designed and operated controls

Audit Evidence - Maintain files showing: - Data validation results (completeness, accuracy checks) - Model documentation and validation reports - Output approval signatures/logs - Monitoring dashboards and results

[Practical Tip]

As you work through these concepts, consider how each one applies to your current role. Think of a specific scenario from your recent work where this concept would have been relevant. Building these mental connections between theory and practice is the fastest way to internalize new knowledge and make it actionable in your daily responsibilities.

Responsible AI and Control Considerations

Bias Monitoring - Input controls should detect biased data (e.g., historical data that reflects past discrimination) - Processing controls should test for model bias - Output controls should monitor for disparate impact (e.g., AI flags one demographic group more than another) - Feedback loop should correct bias when detected

Practice / Reflection Prompts

• Control Mapping: For an AI system you are considering, map out controls for:
• - Data inputs (completeness, accuracy, consistency)
• - Processing (documentation, validation, parameters)
• - Outputs (review, explainability, override mechanism)
• - Monitoring (performance tracking, feedback loop)
• Control Design: For each control, specify:
• - Who performs the control? (person, system, both?)
• - How often? (daily, weekly, monthly?)
• - What is the outcome? (what decision is made based on the control result?)
• - What is the documentation?
• Testing Plan: How would you test each control to verify it is operating? What would constitute passing/failing?
• Monitoring Plan: How will you monitor AI performance over time? What metrics matter? What triggers investigation?

Detailed Examples

The following examples illustrate how the concepts from this lesson play out in real-world oversight scenarios. Each example is designed to help you recognize similar situations in your own work and respond with appropriate professional judgment.

Example 1: Comprehensive Control Design Transaction screening AI with controls for inputs, processing, and outputs: - Inputs: Data completeness, accuracy, consistency are validated daily - Processing: Model is documented, validated, and parameters are controlled - Outputs: Output completeness, reasonableness are monitored; all outputs are reviewed before use - Feedback: Performance is monitored; overrides are tracked; model is retrained when issues are detected

Result: Robust control environment. AI system is auditable and defensible.

Example 2: Weak Control Design (Anti-Pattern) AI model with no controls: - Inputs: No validation; data quality issues are not caught - Processing: Model is a black box; no documentation of how it works - Outputs: No review of outputs; staff assumes they are correct and acts on them immediately - Feedback: No monitoring; if the model is biased or drifting, no one knows

Result: If an issue arises, the organization cannot explain what happened or why. Not defensible to auditors or regulators.

Putting It Into Practice

Workflow integration requires systematic thinking about how these concepts fit into broader organizational processes:

• Design with controls in mind: When integrating AI into workflows, build verification checkpoints and quality controls into the process from the start -- not as afterthoughts.
• Measure effectiveness: Establish metrics that track both the efficiency gains from AI integration and the quality of AI-assisted outputs over time.
• Train and support others: As you integrate AI into team workflows, ensure that all team members understand the controls, verification requirements, and escalation procedures.
• Iterate based on evidence: Use data from your monitoring processes to continuously improve AI-integrated workflows. What works well? Where do errors occur? How can controls be strengthened?

Key Takeaways

• Three pipeline stages: Design controls for inputs (data), processing (model), and outputs (results)
• Control types: Use preventive controls (stop problems early), detective controls (find problems), corrective controls (fix problems)
• Input quality is foundational: Garbage data in = garbage AI output; validate data before processing
• Model transparency: Document how the model works, validate it before deployment, control who can modify it
• Output review is critical: Have humans review outputs before they are used for decisions
• Monitoring and feedback: Track whether AI is working; use feedback to improve over time
• Defensibility: Build an audit trail so you can explain and defend the entire AI pipeline

As you continue through this credential program, you will build on the foundation established in this lesson. Each subsequent lesson adds new dimensions to your understanding and expands your capability to work effectively with AI in oversight roles.