Guide 01 · Step 3 of 5

Design the controls

Now you write down how decisions get made. This is where the guide stops being a spreadsheet exercise.

Independent guidance from Synergy. ISO/IEC 27001, ISO/IEC 42001 and ISO 22301 are published by ISO/IEC, which has no affiliation with Synergy and has not reviewed this material. Always work from the published text of the standard.

Roles. Write a RACI for four decisions, no more: approving a new AI system, changing a live one, handling an incident, and retiring one. Every cell needs a name, not a title.

Policy. Five to eight pages. It says what is allowed, what needs approval, what is forbidden, and who decides. If it runs to forty pages, it is a compliance artefact, not an operating document, and nobody will read it.

Human-in-the-loop, per system. Not "humans review AI output" in general. For each row in the register: which output, reviewed by whom, at what point, with what authority to reject. A review that has never resulted in a rejection is not a control.

Agent identity. Any system that can take actions — send, book, pay, write — needs its own identity, its own permissions, and a documented list of which tools it may call. This is where most companies discover that their automation runs under a human's credentials with that human's full rights.