Describe one financial action before reviewing controls
Apply the checklist to a defined task, such as preparing purchase invoice drafts for an accountant. Identify the permitted source systems, destination record and business owner. A completed checklist for that task does not approve unrelated posting, beneficiary changes or bank payments.
Use pass only when you have evidence for the implemented control. Use fail when the required control is missing or does not behave as expected. Use unknown when the evidence is insufficient. Use not applicable with a reason explaining why the control does not belong to this task.
Twenty-five controls for one financial workflow
Describe the exact record or instruction the agent may prepare or execute.
Name the person who accepts responsibility for the workflow and its exceptions.
Identify the source and destination systems within the approved task scope.
Restrict access to the intended accounts, entities and document groups.
Confirm which operations only retrieve data and which change records.
Keep preparation, posting and payment release distinguishable in permissions and review.
Keep secrets outside generated text and record a protected connection reference.
Ensure document instructions cannot expand the agent’s financial authority.
Require sufficient evidence before associating a proposal with a supplier record.
Route a changed payment destination through the authorized verification process.
Check material values against evidence and retain their original currency.
Define the permitted amount and operation boundaries for this task.
Evaluate concurrent commitments against the actual configured budget mechanism.
Identify who can approve the specific financial action and proposal.
Connect the decision to the unchanged proposal the system will process.
Define which material changes require renewed approval before proceeding.
Demonstrate that revoked access prevents further unauthorized tool operations.
Preserve references supporting each material financial value or decision.
Connect the tool outcome to the resulting financial-system record.
Preserve timeouts and uncertain outcomes without claiming success or failure.
Investigate repeated requests before creating another obligation or instruction.
Assign a responsible person and specific next action to each unresolved case.
Use an action-specific correction or investigation route, without promising universal rollback.
Assign handling and retention decisions to the appropriate organizational owner.
Have another reviewer reconstruct an ordinary case and a blocked case.
Attach an owner and a next action
For each unresolved item, name the person responsible for the follow-up and write a specific action. “Check permissions” is less useful than “Administrator confirms the agent cannot post invoices.” Keep protected credentials and customer data out of the notes. Use the next-action notes to keep a non-sensitive evidence reference beside the follow-up.
Review approval and supervision separately from payment authority. Microsoft documents supervision of agent work and stopping tasks; those features do not establish every subsequent financial permission. Check the actual workflow you intend to authorize. [1]
Export the review and preserve its scope
The controls run locally in this page. Export the states, owner names and follow-up actions for your review record; the portal does not submit them to a service. An unknown item stays unresolved rather than being counted as a successful check.
NIST describes its AI Risk Management Framework as voluntary guidance. This worksheet is likewise a practical review aid and does not certify financial compliance. Use the control and audit guides for the evidence behind the checks. [2]
What the action export should preserve
- Workflow scope
- The financial action being evaluated
- Control state
- Pass, fail, unknown or not applicable
- Evidence
- Reference supporting the state; omit secrets
- Accountable owner
- Person responsible for the follow-up
- Next action
- Specific unresolved task or verification
- Decision boundary
- Review record only; no permission granted by the portal
Fail and unknown answers appear here as you complete the worksheet. Keep an owner and next action for each unresolved control.