Decision Custody Check

A ten-question self-assessment for CIOs and architecture leads in public-sector and regulated organisations.

AI and automation now make or shape decisions about people, payments and records. Someone in your organisation must be able to say who owns each of those decisions, show the record, and explain the result. This check takes five minutes. Answer honestly. Your answers never leave your browser.

How to answer

Answer each question Yes, Partly or No.

  • Yes — true for all the automated decisions you know about, and tested.
  • Partly — true for some decisions but not all, or exists on paper but has not been tested.
  • No — not in place, or you do not know.

Who owns the decision

Question 1 of 10 Do you have a complete list of the places where AI or automation makes or shapes a decision about a person, a payment or a record?

Includes rules engines, scoring models, triage tools and AI assistants that draft decisions for staff.

Question 2 of 10 For each of those decisions, is one named person accountable — not a team, a committee, a vendor or “the system”?

The name should be current and written down where an auditor could find it.

Question 3 of 10 Do you know which decisions run with no human review at all, and has a named executive accepted that risk in writing?

Speed and volume are reasons to automate. They are not a substitute for a signature.

Question 4 of 10 Does your executive or board receive a regular report on which decisions automation makes and how they are governed?

“Regular” means at least once a year and after any major system change.

What is recorded

Question 5 of 10 When an automated decision is made, do you record the inputs used and the exact rule or model version that produced it?

A log that shows only the outcome does not count.

Question 6 of 10 If a vendor or supplier changes a model, a rule or a data source, do you find out before it affects your decisions?

Includes silent model updates in cloud and SaaS products.

Question 7 of 10 Could you reproduce a decision made twelve months ago — same inputs, same logic, same result — if a court or auditor asked?

This needs the old rule or model version, not just the old data.

Who can explain it

Question 8 of 10 Could you explain any one of those decisions to the person it affected, in plain language, within a few days?

The test is whether the affected person could understand it, not whether your data team could.

Question 9 of 10 Can a person challenge an automated decision and have it reviewed by a human with the authority to change it?

A human who can only re-run the same system is not a review.

Question 10 of 10 When an automated decision turns out to be wrong, is there a defined path to stop the automation, fix the error and tell the people affected?

“We would work it out at the time” is a No.