- kickoff
- 2026-10-08
- target complete
- 2026-10-22
Northline Advisory — fictional records
Completed example with unresolved work. No source documents or customer records are included.
Program timeline
AI Governance Policy and Charter
- wording
- Northline Advisory records AI uses, assigns review owners and keeps unresolved evidence visible. Examples cover internal research and advisory delivery. They do not establish permission to use client material or replace engagement and professional review.
- owner
- Practice operations lead
- evidence location
- Fictional draft charter
- last reviewed
- 2026-10-08
- s
- 1
Policy record
- owner
- Practice operations lead
- adopted date
- 2026-10-08
- next review
- 2026-10-22
- review frequency
- Quarterly and on material changes
AI Acceptable Use Policy
No records yet. Follow-up remains open.
AI System and Use-Case Inventory
- System or use case
- ResearchDesk
- Owner
- Engagement partner
- Description and purpose
- Summarize published market research for an internal briefing
- Vendor or in-house
- Vendor
- Data used
- Public reports with source references
- Personal or sensitive data
- No
- Population affected
- Staff
- Risk tier
- Limited
- Frameworks in scope
- Internal working assessment only; not a regulatory classification
- Inventory status
- Approved with conditions
- Last review
- 2026-10-08
- Next review due
- 2026-10-22
- System or use case
- MeetingNote
- Owner
- Engagement partner
- Description and purpose
- Summarize client stakeholder interviews
- Vendor or in-house
- Vendor
- Data used
- Confidential strategy discussions and participant details
- Personal or sensitive data
- Yes
- Population affected
- Staff
- Risk tier
- High
- Frameworks in scope
- Internal working assessment only; not a regulatory classification
- Inventory status
- Declined
- Last review
- 2026-10-08
- Next review due
- 2026-10-22
- System or use case
- ProposalDesk
- Owner
- Engagement partner
- Description and purpose
- Draft a proposal from reusable firm materials
- Vendor or in-house
- Vendor
- Data used
- Firm-owned capability statements and synthetic examples
- Personal or sensitive data
- No
- Population affected
- Staff
- Risk tier
- Limited
- Frameworks in scope
- Internal working assessment only; not a regulatory classification
- Inventory status
- Approved with conditions
- Last review
- 2026-10-08
- Next review due
- 2026-10-22
- System or use case
- WriteAssist
- Description and purpose
- Draft internal emails, agendas and process notes
- Data used
- Internal operational notes only; no client records or personal data
- Risk tier
- Low
- Inventory status
- Approved
- Owner
- Practice operations lead
- Vendor or in-house
- Vendor
- Personal or sensitive data
- No
- Population affected
- Staff
- Frameworks in scope
- Internal working assessment only; not a regulatory classification
- Last review
- 2026-10-08
- Next review due
- 2026-10-22
- System or use case
- ResearchBrief
- Description and purpose
- Summarize published articles and public guidance for internal briefings
- Data used
- Published sources only; summaries are checked against the source before reuse
- Risk tier
- Low
- Inventory status
- Approved with conditions
- Owner
- Practice operations lead
- Vendor or in-house
- Vendor
- Personal or sensitive data
- No
- Population affected
- Staff
- Frameworks in scope
- Internal working assessment only; not a regulatory classification
- Last review
- 2026-10-08
- Next review due
- 2026-10-22
AI Use-Case Approval Form
- Requestor
- Research lead
- Team
- Research
- Date
- 2026-10-08
- Tool or use case
- ResearchDesk
- Data it will touch
- Public reports with source references
- Who is affected
- Staff
- Approved tools considered
- Manual drafting and source review
- Vendor risk assessment
- Not attached
- Proposed risk tier
- Limited
- Decision
- Approved with conditions
- Conditions
- Engagement partner opens cited sources and checks claims before client delivery; restricted to public or synthetic inputs pending supplier review.
- Reviewer
- Engagement partner
- Business purpose
- Summarize published market research for an internal briefing
- Date needed
- 2026-10-22
- Requestor
- Delivery lead
- Team
- Delivery
- Date
- 2026-10-08
- Tool or use case
- MeetingNote
- Data it will touch
- Confidential strategy discussions and participant details
- Who is affected
- Staff
- Approved tools considered
- Continue the existing manual workflow
- Vendor risk assessment
- Not attached
- Proposed risk tier
- High
- Decision
- Declined
- Conditions
- Real-data pilot declined until permission and vendor review are complete.
- Reviewer
- Engagement partner
- Business purpose
- Summarize client stakeholder interviews
- Date needed
- 2026-10-22
- Requestor
- Associates lead
- Team
- Associates
- Date
- 2026-10-08
- Tool or use case
- ProposalDesk
- Data it will touch
- Firm-owned capability statements and synthetic examples
- Who is affected
- Staff
- Approved tools considered
- Manual drafting and source review
- Vendor risk assessment
- Attached
- Proposed risk tier
- Limited
- Decision
- Approved with conditions
- Conditions
- Reason: vendor assessment attached and inputs limited to firm-owned capability statements and synthetic examples. Condition: Practice lead checks that no previous client material or identifiable case detail is reused.
- Reviewer
- Engagement partner
- Business purpose
- Draft a proposal from reusable firm materials
- Date needed
- 2026-10-22
- Decision review date
- 2026-10-22
AI Risk Register
- Risk description
- Two figures in the draft still lack a verified primary source
- Related system or use case
- ResearchDesk
- Category
- Operational
- Likelihood
- Medium
- Impact
- Medium
- Current controls
- Engagement partner opens cited sources and checks claims before client delivery
- Owner
- Engagement partner
- Mitigation action
- Complete the review and record the outcome.
- Due date
- 2026-10-22
- Status
- Mitigating
- Accepted by and why
- Not recorded
- Risk description
- Interview-processing permission is absent from the engagement instructions
- Related system or use case
- MeetingNote
- Category
- Data
- Likelihood
- Medium
- Impact
- High
- Current controls
- Engagement partner checks written client permission and approved retention settings
- Owner
- Engagement partner
- Mitigation action
- Pause the use and obtain the missing evidence.
- Due date
- 2026-10-22
- Status
- Mitigating
- Accepted by and why
- Not recorded
- Risk description
- Two associates have not confirmed their personal-tool use
- Related system or use case
- ProposalDesk
- Category
- Operational
- Likelihood
- Medium
- Impact
- Medium
- Current controls
- Practice lead checks that no previous client material or identifiable case detail is reused
- Owner
- Engagement partner
- Mitigation action
- Complete the review and record the outcome.
- Due date
- 2026-10-22
- Status
- Mitigating
- Accepted by and why
- Not recorded
Data Governance Standard for AI
- wording
- Classify inputs before use: public or synthetic material is distinct from confidential client records. Engagement Alder permits public-source research only. Client interview notes, financial forecasts and prior-client work must stay outside AI tools pending written review.
- owner
- Practice operations lead
- evidence location
- Fictional records / Northline Advisory / E-1
- last reviewed
- 2026-10-08
- s
- 1
- wording
- Use the minimum information needed for the recorded purpose; exclude unnecessary identifiers, credentials and unrelated client material.
- owner
- Practice operations lead
- evidence location
- Fictional records / Northline Advisory / E-2
- last reviewed
- 2026-10-08
- s
- 1
- wording
- Confidential strategy discussions and participant details require a specific review of permissions and safeguards before any approved processing.
- owner
- Practice operations lead
- evidence location
- Fictional records / Northline Advisory / E-3
- last reviewed
- 2026-10-08
- s
- 1
- wording
- Engagement partner must check vendor retention, deletion and training-use settings for the actual account. Unverified settings remain an open action.
- owner
- Practice operations lead
- evidence location
- Fictional records / Northline Advisory / E-1
- last reviewed
- 2026-10-08
- s
- 1
- wording
- Engagement partner opens cited sources and checks claims before client delivery. Record corrections and unresolved checks before sharing output.
- owner
- Practice operations lead
- evidence location
- Fictional records / Northline Advisory / E-2
- last reviewed
- 2026-10-08
- s
- 1
Human Oversight and Escalation Procedure
No records yet. Follow-up remains open.
AI Incident Response Runbook
No records yet. Follow-up remains open.
Roles and Responsibilities (RACI)
No records yet. Follow-up remains open.
ISO 42001 Readiness Checklist
No records yet. Follow-up remains open.
Imported source records
No records yet. Follow-up remains open.