Prepared for
Brightwater Community Trust
A fictional youth and community charity with income of about £640k, 14 staff, 30 volunteers and a board of seven trustees.
Scope and limits
This is a scoped review based on a 60-minute structured call and documents the charity chose to share. It covers eight areas of AI use and financial controls. It is not an audit and gives no assurance opinion. It does not confirm compliance with any law or standard. Findings reflect what we were told and shown on the day.
Summary by area
- AI use inventoryRedNo list of AI tools in use. Five tools found in conversation, two on personal accounts.
- Data protection and retentionAmberPrivacy notice is current. No rule on what data may go into AI tools.
- Access and approvalsAmberTwo-step verification on banking, not on email. Leavers not removed promptly.
- Segregation of dutiesRedFinance officer can set up and approve the same payment.
- Supplier and vendor riskAmberBank detail changes accepted by email. No supplier list.
- Records and reportingGreenMonthly management accounts reach trustees within 15 working days.
- Incident responseAmberStaff know who to call, but there is no written plan and no incident log.
- Staff awarenessGreenInduction covers data protection. Annual refresher in place.
Top five actions
- 1
Require a second approver for every payment over £500, and for all new payees.
Owner: Treasurer and CEO · When: Now
- 2
Confirm any supplier bank detail change by phone, using a number already on file.
Owner: Finance officer · When: Now
- 3
Publish an approved AI tools list and move work use to work accounts.
Owner: Operations manager · When: 2 weeks
- 4
Turn on two-step verification for all email accounts. Remove the three leaver accounts found.
Owner: Operations manager · When: 2 weeks
- 5
Adopt a one-page AI use policy and a one-page incident plan, approved by the board.
Owner: CEO, then trustees · When: 30 days
30-day plan
Week 1
Payment approvals and bank detail checks in place. Leaver accounts removed.
Week 2
AI tools list agreed and shared. Two-step verification on for everyone.
Weeks 3 to 4
AI policy and incident plan drafted, then approved at the board meeting. Supplier list started.
Brightwater Community Trust is fictional. Any resemblance to a real organisation is coincidental. Real reports also include a short note on each finding, the evidence seen, and a follow-up call after 30 days.