Domain I · Area I-CA3 · Information protection, human accountability and tool governance

I.9Maintain human accountability and digital and AI governance

Working Draft version 1.1

Purpose and scope

This unit covers the capability to establish and maintain organisation-wide governance for reporting technologies, automation and AI. It includes policy, use-case and tool inventories, accountable owners, human decision rights, approval, competence, documentation, logging, monitoring, incident and change governance, vendor oversight, transparency, exceptions, periodic review, retirement and reporting to management and governance bodies.

Applied competency statement

Can establish and operate digital and AI governance that preserves human accountability and non-delegable reporting judgement, defines ownership and approval and maintains auditability, monitoring, incident response, change control and lifecycle oversight.

Boundary and escalation

This unit owns enterprise reporting-specific digital and AI governance, inventories, human accountability, monitoring, incidents and lifecycle oversight. I.1 owns individual tool lifecycle, I.2 owns automation design, I.7 owns use-case and model risk and H.3 owns professional judgement. It does not replace enterprise IT, security, privacy, legal, risk or internal-audit governance.

Key quality risks

No accountable owner for a tool, automation or AI use; generic responsible-AI policy not linked to reporting work; business users adopt tools outside inventory; human review stated but not defined or evidenced; materiality, legal, assurance or publication decisions delegated in practice; logs incomplete or inaccessible; vendor and model changes not reviewed; exceptions approved informally; incidents not aggregated; monitoring focused on cost or adoption rather than quality and harm; obsolete tools and prompts remain in use; and governance language creates a misleading impression that all outputs are verified.

Required knowledge · 6

I.9-K01

Understands policy, principles, roles, committees, risk and use-case owners, technology and model owners, users, reviewers, legal, privacy, security, procurement, internal audit and governance interfaces.

Knowledge Type: Governance architecture · Normative Weight: Core

I.9-K02

Understands non-delegable judgement, responsible party, preparer, reviewer, approver, human-in-the-loop and human-on-the-loop concepts and the need for substantive rather than nominal oversight.

Knowledge Type: Human accountability · Normative Weight: Core

I.9-K03

Understands tool, model, automation, connector, agent and use-case inventories, owner, purpose, data, vendor, risk, approval, version, status and restriction fields.

Knowledge Type: Inventory and approval · Normative Weight: Core

I.9-K04

Understands prompts, inputs, outputs, sources, models, versions, logs, decisions, edits, approvals, exceptions, incidents and retention needed to reconstruct material digital and AI use.

Knowledge Type: Transparency and auditability · Normative Weight: Core

I.9-K05

Understands quality, error, exception, bias, security, privacy, adoption, override, change, drift, vendor, cost, incident, remediation, suspension and retirement monitoring.

Knowledge Type: Monitoring and lifecycle · Normative Weight: Core

I.9-K06

Understands enterprise policy dependencies, internal audit and assurance boundaries and the need not to describe governance or human review as proof that every output is reliable or compliant.

Knowledge Type: Governance boundary and claims · Normative Weight: Core

Applied skills · 5

I.9-S01

Design reporting-specific digital and AI governance roles, principles, decision rights, escalation and interfaces with enterprise functions.

Skill Type: Core applied capability · Observable Output or Result: Digital and AI reporting governance framework and policy

I.9-S02

Establish controlled inventories, risk and approval fields, permitted and restricted use, exception routes and periodic renewal.

Skill Type: Inventory and approval governance · Observable Output or Result: Tool, model, automation and use-case inventory and approval register

I.9-S03

Define non-delegable decisions, human review depth, competence, evidence, segregation, approval and override rules for each material use.

Skill Type: Human-accountability design · Observable Output or Result: Human-accountability and approval matrix

I.9-S04

Aggregate quality, exception, bias, security, privacy, vendor and change information and route incidents, remediation and restrictions.

Skill Type: Monitoring and incident governance · Observable Output or Result: Human-accountability, monitoring, incident and lifecycle report

I.9-S05

Review continued fit, logs, exceptions, changes and controls and suspend, retire or replace tools and use cases while supporting internal review without overstating assurance.

Skill Type: Lifecycle and assurance of governance · Observable Output or Result: Digital and AI governance effectiveness review

Professional behaviours · 3

I.9-B01

Does not allow a tool, model, vendor or automated workflow to become the de facto decision owner for a material reporting judgement.

Behaviour Type: Human accountability · Non-compensable Requirement: No

I.9-B02

Does not rely on a generic policy, disclaimer or nominal human approval where actual use, review, logs and controls are not demonstrated.

Behaviour Type: Governance substance · Non-compensable Requirement: No

I.9-B03

Does not permit unregistered, expired, changed or repeatedly unsafe tools and use cases to continue without reassessment, restriction, suspension or retirement.

Behaviour Type: Lifecycle accountability · Non-compensable Requirement: No

Typical tasks · 4

I.9-T01

Map existing tools, models, automations, use cases, owners, enterprise policies, decision rights, logs, controls and governance gaps.

Primary Output Link: I.9-O01

I.9-T02

Create and operate inventories and approval, restriction, exception, renewal and change processes.

Primary Output Link: I.9-O02

I.9-T03

Define and test human accountability, competence, review, evidence, approval and override arrangements for material uses.

Primary Output Link: I.9-O01

I.9-T04

Monitor incidents, performance, changes and vendor risk and report to management, remediate, suspend, retire and archive as needed.

Primary Output Link: I.9-O03

Expected outputs · 3

I.9-O01

Digital and AI reporting governance framework and policy

Output Type: Professional work product

I.9-O02

Tool, model, automation and use-case inventory and approval register

Output Type: Professional work product

I.9-O03

Human-accountability, monitoring, incident and lifecycle report

Output Type: Professional work product

Proficiency indicators

Level 1 · Foundation

I.9-L1-01

Can use approved tools and AI use cases, maintain assigned inventory and approval records and follow human-review, incident and exception rules.

Indicator Dimension: Task execution

I.9-L1-02

Can identify an unregistered, changed, expired or judgement-delegating use and stop or escalate it.

Indicator Dimension: Quality, judgement and accountability

Level 2 · Practitioner

I.9-L2-01

Can independently operate digital and AI governance for a moderately complex reporting function, including inventories, approvals, human review and monitoring.

Indicator Dimension: Task execution

I.9-L2-02

Can resolve routine ownership, exception, change and monitoring issues and explain residual risk and lifecycle actions to management.

Indicator Dimension: Quality, judgement and accountability

Level 3 · Advanced Practitioner

I.9-L3-01

Can design or critically review enterprise digital and AI reporting governance across complex groups, technologies, vendors and decision contexts.

Indicator Dimension: Method design and review

I.9-L3-02

Can challenge nominal or fragmented governance, resolve significant accountability and incident failures and advise governance bodies on risk acceptance, suspension, retirement and public claims.

Indicator Dimension: Leadership and governance

Illustrative evidence · 6

I.9-E01

Digital and AI reporting governance framework and policy.

Evidence Type: Work product

I.9-E02

Tool, model, automation and use-case inventory and approval register.

Evidence Type: Work product

I.9-E03

Human-accountability, monitoring, incident and lifecycle report.

Evidence Type: Work product

I.9-E04

Owner, approval, prompt and log, review, exception, change, incident, suspension, retirement and archive trail.

Evidence Type: Process evidence

I.9-E05

Documented IT, security, privacy, legal, procurement, ethics, internal-audit, quality or governance review and the practitioner's response.

Evidence Type: Review evidence

I.9-E06

Observed governance decision on a high-risk, unregistered, changed or repeatedly unsafe digital or AI use.

Evidence Type: Observed performance

Assessment · 3

I.9-A-L1

Inventory and governance exercise, accountability scenario and situational judgement

Governance and inventory understanding; human accountability; change and escalation awareness.

I.9-A-L2

Integrated digital-and-AI governance case and professional memorandum

Role and policy design; inventory and approval; human accountability; monitoring, incident and lifecycle governance.

I.9-A-L3

Complex enterprise governance case, portfolio and oral defence

Method design; accountability and auditability; incident and lifecycle decisions; governance advice and oral defence.

Relationships · 11

From	To	Type	Rationale
D.5	I.9	Digital and technology linkage	Tool and automation changes require ownership, approval, audit trail and monitoring.
E.9	I.9	Digital and technology linkage	Tool ownership, logs and human approval support reliable lineage and accountability.
I.1	I.9	Governance and role linkage	Tool ownership, approval, inventory, monitoring and lifecycle status are maintained through digital and AI governance.
I.2	I.9	Governance and role linkage	Automation ownership, approval, monitoring, incident and retirement are governed at enterprise level.
I.7	I.9	Governance and role linkage	Permitted, restricted and prohibited use and monitoring are maintained through governance.
I.8	I.9	Governance and role linkage	Permitted data use, incidents, exceptions and vendor risk require enterprise ownership and monitoring.
I.9	C.1	Governance and role linkage	Digital and AI governance should integrate with reporting oversight, management accountability and escalation.
I.9	C.2	Governance and role linkage	Tool, model, use-case, data, review and approval responsibilities should align with formal decision rights.
I.9	H.1	Professional conduct and collaboration linkage	Human accountability and due care remain fundamental when digital and AI tools are used.
I.9	D.5	Change and lifecycle linkage	Tool, model, prompt, configuration and use-case changes and incidents should follow controlled decision and change governance.
I.9	G.11	Disclosure, claims and publication linkage	Digital and AI use affecting published information should be included in release, correction and post-publication controls.

Role profiles for this unit

Role	Target level	Relevance	Evidence expectation
Corporate Sustainability Reporting Practitioner	Practitioner	Required?	A case or work sample demonstrating independent performance, documented judgement and a reviewable professional output.
Sustainability Reporting Manager or Lead	Advanced Practitioner	Role-defining?	A complex case or verified portfolio, supplemented by oral or observed defence, demonstrating method design, challenge and governance capability.
Sustainability Reporting Adviser or Consultant	Advanced Practitioner	Role-defining?	A complex case or verified portfolio, supplemented by oral or observed defence, demonstrating method design, challenge and governance capability.
Sustainability Data, Systems and Controls Specialist	Advanced Practitioner	Role-defining?	A complex case or verified portfolio, supplemented by oral or observed defence, demonstrating method design, challenge and governance capability.
Assurance Readiness and Reporting Quality Specialist	Advanced Practitioner	Role-defining?	A complex case or verified portfolio, supplemented by oral or observed defence, demonstrating method design, challenge and governance capability.
Investor, Capital Markets and Ratings Disclosure Specialist	Advanced Practitioner	Role-defining?	A complex case or verified portfolio, supplemented by oral or observed defence, demonstrating method design, challenge and governance capability.