Can your firm prove which SOP governed an AI-assisted decision?

A professional-services firm should be able to trace an AI-assisted decision to the standard operating procedure (SOP) that applied at the time, and identify who approved that procedure and who checked the resulting work. Keeping only the latest SOP may not be enough to reconstruct an earlier decision.

For client work, this helps partners and process owners answer practical questions about expected steps, accountability and human review. The aim is a proportionate evidence trail-not a claim that a version number alone proves compliance or a correct outcome.

What should the decision record connect?

Start with a recent, low-risk example and identify the minimum records needed to reconstruct it. Depending on the process, these may include:

• The use case and accountable process owner.
• The SOP identifier, version and effective date, with evidence of who approved the change.
• A stable reference to the AI-assisted run or client matter, without copying sensitive client content into an unnecessary log.
• The relevant tool or configuration and permitted data category.
• The reviewer or responsible role, the check performed, and any correction, override or escalation.
• The location of the resulting decision and who can access or change the evidence.

Test whether you can reconstruct a past decision

Ask the process owner to work through an authorised example using the records the firm would actually show a reviewer. Can they identify the SOP version that applied on that date? Can they find its approval and change history? Can they connect the AI-assisted work to the human check and final decision? Can an authorised reviewer retrieve the evidence without seeing unrelated client material?

Record any missing links and decide what to do next. Depending on the risk and evidence available, the firm might keep the task manual, permit a limited AI assist with a named check, or defer use until evidence and access controls are ready. Do not assume that a search screen, activity feed or vendor assurance label answers these questions; inspect the configuration and an authorised example.

Match controls to the work

Administrative tasks do not necessarily need the same record as advice, regulated reporting or work involving confidential client information. Consider the decision’s consequences, data sensitivity, who relies on the output and where professional judgement must remain visible. Set a proportionate control, name its owner, and define when a person must review, correct or stop the process.

Pattrn Data’s AI Risk & Efficiency Audit can help map the work, data, owners, handoffs, review points and controls before tool spend or process change.

Source and provenance

Source question: “Can we prove which SOP version governed a past decision?” Source: Zanus AI, Business Operations Compliance. Product and audit-history statements in that source are vendor claims, not independent assurance; assess any system against your own authorised records and requirements.