Operational Intelligence Audit
Operational Intelligence Audit™Deliverable 05 of 07 · Illustrative deliverable
Guard Rail™ · Governance and risk framework

An illustrative governance framework

A proposed set of principles, review points and workflow roles that a live engagement could adapt to its own data, people and terms.

Client
Hartwell M&E Group
Maturity
2.4 · of 5.0
Workflows in scope
6
Suggested cadence
Quarterly
Prepared by
BuiltAI Intelligence Ltd
Status
Example framework

Illustrative worked example: fictional project and parties; figures, names and dates are fictional scenario details.

5Governance principles
3Data classification tiers
6Workflows in scope
QuarterlySuggested review cadence
BuiltAI Intelligence Ltd · built-ai.ioBAI-HME-AUD-005 · May 2026
01Principles

Five principles, one rule: people decide

This example sets out five proposed principles for a live workflow: assign human review; agree what data is needed and how it is handled; keep source references and versions; adapt review to risk; and revisit the approach as the engagement develops.

The rule under all five

A live engagement could assign a competent person to review drafts and make the relevant decisions before use.

02Gates

Example data tiers and review roles

This example groups data into three tiers and suggests reviewer roles by output. A live engagement could define its own categories, safeguards and review responsibilities to fit its data and terms.

Example outputExample riskPossible reviewer role
RAMS and safety documentationHighCompetent H&S reviewer, then Operations Director
Client-facing commercial submissionsHighQS or Commercial Manager, then Commercial Director
Tender responses and bid documentsMedium to highEstimating Lead, with Commercial Director on high-value bids
Variation narratives and noticesMediumQS or Contract Manager, with Commercial Director on high-value claims
Monthly contract reportsMediumContract Manager
Internal summaries and action logsLowWorkflow user, self-review
Under time pressure

A live engagement could define review steps that remain workable near a deadline; this example does not establish controls already in operation.

03Trail

Example recordkeeping approach

An engagement could define records for inputs, drafts, reviews and final outputs, with access and retention periods set by its approved terms.

For a live tender or client request, check the applicable requirement and use wording agreed for that engagement; this framework suggests openness without setting a universal disclosure rule.

Possible processing logInputs, steps and exceptions, if defined for the engagement
Possible version recordDraft, reviewed and final versions, if required by agreed terms
Possible review recordReviewer, approver and decision details, as agreed
04Roles

Example responsibilities to assign

Before a live workflow, an engagement could assign responsibilities such as the example roles below to suit its people, controls and terms.

Example rolePossible responsibilityExample role holder
Framework ownerThe controls, the review cadence and any change to themOperations Director
Data classificationThe tier of each data set and any restricted-data approvalCommercial Director
Competent reviewerChecking each draft against its source before approvalNamed per output in the gate table
ApproverThe sign-off decision and the outcome that follows itDirector named per output in the gate table
Workflow userRunning the workflow within the controls and raising exceptionsEach trained user
05Review

Keeping the framework live

This example suggests a review cycle that a live engagement could adapt to its needs and approved terms.

Quarterly, first yearSuggested example cycle for reviewing the proposed framework and decisions
Annually, thereafterSuggested lighter review after the first year, if appropriate to the engagement
On a material changeConsider an earlier review after a material change, such as a new workflow or changed requirement
Reference BAI-HME-AUD-005Scope Six workflowsReview Quarterly, then annually

Up next

FP · Flight Plan Back to the Operational Intelligence Audit page