AI Drafts It. A Human Approves It. Nobody Chases It.

AI can make decisions without adequate oversight, while manual compliance can consume expert time with collection, mapping, and follow-up.

A clear division of labor addresses both risks. Let the system handle collection, mapping, and drafting, and reserve human attention for judgment and approval.

Use systems for repeatable work and people for accountable decisions. Collection, mapping, drafting, tracking, and assembly are high-volume tasks. Judgment, prioritization, and risk trade-offs require context and an accountable person.

The system reads the requirement, gathers the evidence, maps it, and drafts the response. A person reviews the draft, applies judgment, and approves or corrects it. The workflow tracks the steps between drafting and approval.

Design human oversight into workflows where the risk calls for it. The NIST AI Risk Management Framework has four functions: Govern, Map, Measure, and Manage. NIST describes Govern as a cross-cutting function that informs the other three.

NIST notes that some AI systems may not require human oversight while others may require it. MAP 3.5 says organizations should define, assess, and document human-oversight processes according to policies from the Govern function. For consequential compliance positions, define the reviewer, route the draft to that person, and keep the decision record.

Give the reviewer a precise approval record. A governed assessment answer should include the requirement, AI draft, cited evidence passage, confidence or coverage signal, reviewer, decision, and timestamp. Keep prior versions when the answer changes.

The reviewer approves a claim, its evidence, and the obligation it satisfies. If the reviewer rejects it, route the gap back to an owner instead of leaving the draft in chat history.

Do not rely on someone remembering to review a draft. Require the review in the workflow.

In Sorena Assessment, the system extracts requirements, gathers evidence, and drafts the mapped response. A person must review and approve it before it is final. Each draft links to evidence and each approval is logged.

Risk decisions need an owner, and that owner is a person. Deciding whether a control is adequate, whether a gap is acceptable, or how to prioritize remediation is a judgment call with consequences. Those calls belong to accountable people, not to a model.

Risk work stays human-led. When Sorena surfaces a gap or a concentration of exposure, it hands the decision to the people who own it in Sorena Risk Management, with the evidence assembled and the context in front of them. The system removes the grunt work of finding and formatting. The human keeps the part that requires accountability. Humans decide, systems execute.

Track the handoff from draft to approval. In manual work, a draft can sit after the approval request until a deadline forces follow-up.

Once the system routes a draft for approval, it should track the item, owner, evidence, and due date through completion. The reviewer receives the material needed to make the decision without manually chasing status.

Keep people responsible for judgment and approval. Use the system to collect, map, draft, route, and record the work around that decision.

AI drafts it. A person approves it. The system tracks the handoff and keeps the evidence and approval record.