Laying the foundations

Moving towards AI-assisted compliance starts with getting our information into a form that both people and AI can use. Evidence is scattered across folders and inboxes. Assessments sit in Excel spreadsheets, sometimes detached from the documents that support them. Important qualifications survive in comments or meeting notes that the next reviewer may never see.

An AI agent asked to review a selection of those materials will have a partial view. It may produce a useful analysis, but its conclusions depend on what it was given. To use AI effectively, we need to connect the underlying evidence and embed its contribution in a workflow that preserves review, challenge and accountability. That is a real challenge at many investment firms, where evidence, information and sign-offs live in different documents.

Bring the evidence together

The first step is to establish a connected record of the assessment. That means linking each requirement to the relevant business activity, controls, supporting evidence and assessment narrative. Reviewers should be able to see which documents were considered, whether they are current and what remains outstanding.

This does not require every document to move into a single database. Existing repositories can remain in use if the workflow can retrieve the right versions and preserve their relationship to the assessment. The practical test is whether a reviewer can follow a conclusion back to the information that supported it.

That context also gives AI a more useful task. It can compare the supplied evidence with the stated requirements, flag potential gaps and identify inconsistencies between documents and assessment narratives. Its access and limitations should be clear. A gap check can help identify missing material; it cannot establish that the entire evidence base is complete.

Embed AI in review and challenge

Giving an agent a folder of documents is only part of the process. A compliance assessment develops through questions, responses and revisions. The business may qualify an initial statement. Compliance may ask for additional testing. A finding may remain open until someone provides evidence that the issue has been resolved.

Those exchanges need to remain attached to the assessment. Otherwise, the final narrative can lose the reasoning that made it defensible. An important comment disappears into an email chain, a revised spreadsheet overwrites an earlier version, and the sign-off records approval without explaining what changed.

Six months later, Internal Audit asks why a particular conclusion was accepted. The team spends time reconstructing the decision from old messages and people’s memories. Work that could have been recorded as part of the assessment becomes a separate exercise in explaining it afterwards.

An embedded AI contribution should follow the same discipline. Suggestions should be linked to their supporting material. Reviewers should be able to accept, amend or reject them and record a rationale where it matters. Further evidence and responses should remain visible alongside the original question.

Preserve accountability across the three lines

AI can support each line’s work while preserving its responsibilities. The first line should own the business assessment and the accuracy of the evidence it supplies. AI can help organise that material, identify unanswered questions and prepare a draft for the accountable owner to review.

The second line should be able to examine the evidence, test the business’s reasoning and challenge the proposed conclusion. AI can offer another perspective, highlight contradictions or suggest questions for further investigation. That assistance still needs an informed reviewer who can decide whether the issue matters and what response is appropriate.

Internal Audit needs independent visibility of how the process operated. Access to the assessment history can help it examine what was reviewed, which challenges remained unresolved and how approval was reached. Its independent judgement should remain separate from the business and Compliance decisions being assessed.

A connected workflow should therefore preserve ownership, access permissions and separate review decisions. If the same AI suggestion passes through every stage without substantive scrutiny, the existence of several approval steps tells us little about the quality of the challenge.

Make the human contribution visible

Embedding AI also creates an opportunity to make its use more transparent. A system can label content generated through its own AI features and retain the original draft alongside subsequent changes. That provides a clearer record of where AI contributed than an unlabelled passage copied into a final document.

For a material assessment, the history should show the information supplied to AI, the draft or suggestion it produced, and the reviewer’s response. It should retain significant changes to the narrative, outstanding questions and the basis for final approval. Content imported from outside that workflow may still need a declaration of how it was prepared.

Consider an AI draft that describes a control as effective. A human reviewer identifies that the testing excludes one business activity, narrows the conclusion and raises a remediation action. Preserving that sequence shows how review affected the outcome. It also gives a later reviewer the context needed to assess the original decision.

An audit log supports that assessment; it does not, by itself, prove that the evidence was sufficient or the judgement sound. A recorded approval may still amount to a rubber stamp. We need to examine the substance of the review as well as the fact that it occurred.

This is the approach behind Cerylis: connect the evidence, assessment, challenge and decision, with AI contributing within that process. The aim is to reduce the administrative burden and give reviewers another perspective while keeping human judgement visible and accountable. That is a practical foundation for AI-assisted compliance.