Stage purpose
Test technical and operating claims on representative, sanitized records without allowing outputs to enter a live accountable decision.
Use-case boundary
AI can index control narratives, map evidence requests, and flag missing documentation. It cannot by itself establish control design, operating effectiveness, audit sufficiency, or management's conclusion.
Write the specific population, users, systems, source records, proposed AI contribution, human decision, allowed action, and business consequence. State what remains outside the stage. A bounded plan prevents a successful test of one narrow task from becoming an unsupported approval for a broader operating process.
Entry condition
The discovery charter is approved, the test population is representative, and data handling, access, evaluation criteria, and incident response are agreed.
Do not waive the entry gate because a tool is already licensed or a provider offers a short implementation window. Existing access can reduce procurement time, but it does not resolve purpose, authority, evidence, ownership, privacy, security, operating fit, or measurement.
Work to complete
- run a normal case and difficult exceptions
- capture inputs, versions, outputs, review actions, and errors
- compare against the existing method
- test challenge, override, and fallback
- record provider and customer dependencies
Controlled evidence test scenario
For internal control and audit evidence, select one decision with a known outcome and one unresolved case that represents the edge of the intended scope. Document the people, source systems, records, timing, current work, consequences, and existing controls. Run only the actions allowed at the controlled evidence test stage, and keep any generated or recommended output outside a broader production decision until the exit gate is met.
The stage owner should be able to explain why this population is representative, which groups or situations are excluded, how a user challenges an output, where a difficult exception goes, and what evidence will support the next decision. If those answers are not yet available, the correct result may be to narrow the stage rather than accelerate it.
Test design
Use representative records and preserve the denominator. Include a normal path, missing information, contradictory evidence, an unusual case, an authorized override, and a changed source, policy, model, or integration. Capture input, version, output, reviewer action, time, error, rework, exception, and downstream consequence for every test case.
Decision questions
- Is the AI itself in scope for change and access controls?
- Can evidence provenance survive export and retention?
- Who resolves conflicts between a summary and the underlying record?
Evidence requirements
- traceable inputs
- reviewable outputs
- human decision record
- measured outcome and failure evidence
Risk and incident controls
- false assurance
- incomplete populations
- privileged or confidential evidence leakage
Name the person who can stop the stage, the event that requires immediate pause, the fallback process, how affected records will be corrected, who must be notified, and what evidence is needed before work can resume. The plan should also address participant feedback and challenge when outputs affect people, customers, partners, investors, or regulated activity.
Measures
| Dimension | Measure | Decision use |
|---|---|---|
| Quality | Correct, incomplete, unsupported, conflicting, and materially wrong outputs | Determine whether review is practical and error is acceptable |
| Work | Cycle time, touch time, rework, exceptions, and support burden | Test the complete operating case rather than generation speed |
| Outcome | Role-specific business result against the baseline and comparison group | Separate activity from value |
| Risk | Incidents, near misses, complaints, overrides, and affected populations | Test whether controls and escalation work |
| Adoption | Correct use, avoidance, workarounds, challenge, and confidence calibration | Understand whether the operating model is usable |
Authority and policy checkpoint
ISO/IEC 42001
Assess whether an organization has a defined management system; verify scope rather than relying on a badge.
The authority record does not certify a product, provider, program, or organization and does not determine buyer-specific applicability.
SEC disclosure review observations on AI
Challenge boilerplate and require a reasonable basis for material AI claims.
The authority record does not certify a product, provider, program, or organization and does not determine buyer-specific applicability.
Official sources for the stage review
ISO/IEC 42001 — ISO/IEC. The authority record does not certify a product, provider, program, or organization and does not determine buyer-specific applicability.
SEC disclosure review observations on AI — U.S. SEC Division of Corporation Finance. The authority record does not certify a product, provider, program, or organization and does not determine buyer-specific applicability.
Exit condition
The team has reproducible evidence about quality, failure modes, review burden, control feasibility, and unresolved claims—not merely a successful demonstration.
The exit record should state what was observed, which claims were supported or rejected, which limitations remain, whether the population was representative, who approved the decision, and what evidence could reverse it. Silence or project momentum is not approval.
The publication supports research and executive decision preparation. It does not provide legal, financial, accounting, employment, clinical, cybersecurity, investment, procurement, or implementation advice.