AI & Controls Self-Check

Question 1 · AI use inventory

Do you know which AI tools your staff and volunteers use for work?

Question 2 · AI use inventory

Have you decided which AI tools are allowed for work?

Question 3 · AI use inventory

Does someone own decisions about AI use in your organisation?

Question 4 · Data protection and retention

Is there a clear rule about what information can go into AI tools?

Question 5 · Data protection and retention

Do you know how long you keep personal data, and do you delete it when the time is up?

Question 6 · Data protection and retention

Have you checked the privacy and data settings of the AI tools you use?

Question 7 · Access and approvals

When someone leaves, how quickly is their access to email, banking and finance systems removed?

Question 8 · Access and approvals

Is two-step verification switched on for email, banking and finance systems?

Question 9 · Segregation of duties

Can one person set up and approve a payment on their own?

Question 10 · Segregation of duties

Does someone independent review the bank statements and reconciliations each month?

Question 11 · Supplier and vendor risk

How do you handle a request to change a supplier's bank details?

Question 12 · Supplier and vendor risk

Do you know which suppliers and software tools hold your data?

Question 13 · Records and reporting

Do trustees or managers get a regular, consistent finance report?

Question 14 · Records and reporting

Where are finance records and supporting documents kept?

Question 15 · Records and reporting

If figures or reports are produced with help from AI, are they checked against the source?

Question 16 · Incident response

If data went to the wrong place tomorrow, would people know what to do?

Question 17 · Incident response

Do you record incidents and near misses?

Question 18 · Staff awareness

Have staff had any guidance on using AI safely?

Question 19 · Staff awareness

Are AI and data rules part of induction for new staff, trustees and volunteers?

Question 20 · Staff awareness

Would staff feel able to report a mistake, such as pasting the wrong data into an AI tool?