The VERIFY → REVIEW → APPROVE model
Verify: establish the source, date, scope, evidence and limitations.
Review: assess the signal or requirement in context, challenge assumptions and record exceptions.
Approve: assign the accountable decision-maker, document the rationale and define follow-up.
This framework is a decision-support aid. It does not replace applicable law, regulation, internal policy or professional judgment.
Where to apply it
- Regulatory change and control-impact review
- Financial-crime and transaction-risk triage
- Responsible AI use-case assessment
- Supervisory and assurance workpaper design
Additional practical models
AI Use-Case Risk Triage
Classify a proposed AI use case by impact, data sensitivity, reversibility, autonomy and human-oversight needs before deployment.
- Purpose and affected party
- Risk tier and prohibited action
- Owner, evidence and review date
Third-Party AI Due Diligence
Structure vendor review around model scope, data handling, subcontractors, resilience, explainability, incident reporting and exit planning.
- Capability and limitation map
- Contractual control checklist
- Test, monitor and exit plan
Regulatory Change Impact Review
Move from a circular or rule change to accountable action by mapping obligations, affected controls, evidence and implementation owners.
- Verify source and effective date
- Map impact and control gaps
- Approve action and follow up