Methodology
How control ratings work
Every workflow gets an overall rating, and every step gets its own. Here's what each one means.
| Rating | Meaning |
|---|---|
| Safe to automate | Low-judgment, reversible, fully checkable output. AI can run it; a person spot-checks. |
| Human review | AI prepares, matches, drafts or flags. A named person reviews every output before it is used. |
| Never automate | Judgment, approval or posting steps. AI may inform them; it never performs them. |
How we decide
A step is Safe to automate only if all of these are true: the output can be fully re-performed or checked against a system of record, it doesn't involve accounting judgment, it's reversible, and an error would be caught by an existing control downstream. Examples: profiling a file, aging a request list, computing fluxes from system trial balances.
A step is Human review when AI is doing real preparation (matching, drafting, flagging, extracting) and a named person has to review each output before anyone relies on it. Most of the library sits here, and that's deliberate.
A step is Never automate when it involves an approval, a posting, a conclusion under GAAP, an estimate, or a representation to a third party (auditors, the board, lenders). AI can inform these steps. It doesn't perform them.
The overall rating
The overall rating on a workflow describes the AI's main role in it. The control map on each page rates every step separately, so a "Human review" workflow can still contain a "Never automate" step, and usually does.
What ratings are not
Ratings aren't a SOX opinion, and they don't replace your control design. If you plan to rely on an AI-assisted step as part of a key control, document it and agree it with your auditors first.