Internal control
From the automated decision to the evidence
When AI decides, someone is accountable.
AI decidesA person is accountableIt's on record- AI decides
- A person is accountable
- It's on record
The pieces
The controls in every cell
Automation doesn't combine duties that internal control keeps separate.
Control 01
Owner per decision
Every automated decision has an approval owner.
Control 02
Segregation of duties
The person who configures the rules isn't the one who approves their output.
Control 03
Versioned record
Every output is recorded with the version of the rules that produced it. What is recorded is never rewritten.
Control 04
Exception routing
Whatever falls outside the rules goes to a person with the case and its context, and the decision is recorded.
Control 05
Calculations with code
Arithmetic and decisions on amounts run on code, not on a language model.
An AI decision that serves as evidence is a control, tested like any other.
What it looks like
The controls in the console
The settings and the audit trail of Capital project control.
- Segregation of dutiesManagement defines who approves what, in the cell settings.
- Versioned recordEvery entry keeps its user and its cell.
Demo console, with fictitious data.
The detail
The COSO framework applied to AI
The five components of the framework, per the COSO guidance on generative AI, and how traza.'s design covers them.
Control environmentAn owner and separate duties
Every solution has an owner, and the person who configures doesn't approve.
Risk assessmentAI according to the risk of the process
Code where an error affects financial information; AI where an error is caught in a later step.
Control activitiesGoverned configuration and human review
AI proposes, a function validates and executes, and anything uncertain goes to a person.
Information and communicationEvery result can be reconstructed
A record that is never modified, with what produced each result.
Monitoring activitiesTesting whether the controls work
Switching off a control leaves an alert, and the AI is revalidated when the model changes.
Source: COSO, Achieving Effective Internal Control Over Generative AI (2026).
Let's find which controls each process needs.
The starting point is a conversation about the processes and the controls still run by hand today.
Book a callTo find where to start
To work on a specific process