AI GOVERNANCE / DOA / INTERNAL CONTROL
Judgment and DOA: approval authority when AI assists preparation
Extend delegation of authority beyond monetary limits to judgment, automated rules, evidence and exception resolution in finance.
Delegation of Authority (DOA) establishes who may decide which matters, within what scope and conditions. Judgment considers how a decision should be made using available evidence. A useful DOA routes matters to people with appropriate authority, competence and information.
When AI assists preparation, the proposer may be unable to explain a number’s origin and the approver may see only a summary. Building on our human oversight article, this discussion applies authority design to financial closing and reporting. The examples are DHISORA’s design proposals, not universal requirements or client case studies.
Related article: judgment and human oversight
Understand roles before reading the authority tables
The process owner coordinates end-to-end outcomes, participants and remediation within assigned authority. The system owner is responsible for the supporting system; a control owner ensures assigned controls operate and deficiencies receive follow-up. None of these titles automatically grants approval authority over every transaction.
RACI identifies Responsible, Accountable, Consulted and Informed roles. An SOP, or standard operating procedure, explains how an activity is performed. Align both with DOA and actual system permissions.
Escalation means routing a matter and evidence to suitable expertise or authority. It may involve specialist assessment or the relevant transaction approver, rather than automatically adding one approval level.
Delegate authority with clear responsibilities
The delegate is responsible for exercising authority within the assigned role. The delegator retains oversight duties under applicable law and organisational arrangements. Responsibility should not be described as belonging only to the delegator or as transferring completely. Internal approval, authority to bind the company and system access are distinct matters that need alignment.
| Document or mechanism | Purpose |
|---|---|
| DOA | Defines authorised roles, transaction types, scope, conditions and escalation. |
| Job description / RACI | Defines preparation, accountability, consultation and information roles; does not automatically confer approval authority. |
| Segregation of duties | Addresses self-review and conflicting roles according to risk; AI is not another accountable person. |
| System access and signing authority | Aligns execution and external commitments with actual authority. |
Monetary size and judgment are separate dimensions
Value captures only part of risk. Uncertainty, conflicts of interest, disclosure and contractual consequences can require substantial judgment even at low amounts. This matrix routes matters for review; it is not a statutory authority table. Judgment need not be assigned a numerical score.
| Value | Judgment needed | Routing approach |
|---|---|---|
| Low | Low | Routine work within approved criteria and sufficient evidence. |
| Low | High | Suitable specialist review and an authorised decision-maker for the matter. |
| High | Low | The appropriate monetary authority level, with checks of evidence and conditions even for routine work. |
| High | High | Escalation based on requirements and risk, supported by assumptions and alternatives; board or shareholder approval where applicable. |
Rule approval is not unconditional approval of every output
AI does not become an authorised DOA approver. A system may execute within an approved operating scope. Approving a rule authorises a conditional process; it does not establish that the rule approver has reviewed and approved every future transaction.
Specify the rule owner, eligible and prohibited actions, per-item limits, aggregate limits by period, data-quality conditions, exceptions and stopping criteria. The approval level should consider aggregate impact, reversibility and applicable duties together, rather than only the sum of one period’s transactions.
Matching reconciliation items, writing off differences, posting entries and paying money are different actions. Permission to match does not authorise the others. Missing evidence or exhausted aggregate limits should hold and escalate the action. A personal agent using a manager’s approval account can undermine authority controls and actor traceability.
Extend DOA and the supporting control documents
DOA need not contain every technical detail. It can state authority and core conditions while referencing AI policy, SOPs and change controls. Adapt these roles to the organisation; the table does not require CFO or audit committee approval of every use case.
| Matter | Role to define | Supporting conditions |
|---|---|---|
| AI policy and scope | Authorised policy role | Permitted data, prohibited actions, risk boundaries and reporting. |
| Activate automated rules | Process owner and authorised rule approver | Test results, aggregate limits, exceptions, stopping and monitoring. |
| Significant changes | Process owner and risk-appropriate change approver | Separation of editing and approval as designed; testing and rollback. |
| Resolve exceptions / override | Authority appropriate to the substance and impact | Distinguish data correction from risk acceptance; evidence and reasons for accepting or rejecting recommendations. |
| Accounting estimates | Responsible management and authorised roles | Review data, methods, assumptions, sensitivity and disclosure. |
Apply the design to financial closing
Reclassification may leave profit unchanged while affecting loan covenants. Estimates need review of methods and assumptions, not only outputs. Late entries require timely review appropriate to risk, rather than automatic escalation by one level for every entry.
A person making substantive changes to AI output may also act as preparer, requiring attention to self-review. However, reviewing output does not always make the reviewer a preparer. Senior-management entries need suitable escalation where normal reporting lines cannot support effective challenge.
Internal audit may independently assess and report deficiencies. It should not automatically become management’s approver or control owner. Additional roles require safeguards for independence and objectivity [3].
Define the evidence needed before deciding
A process exception is an item outside normal criteria or with insufficient information. Closing it requires a supported resolution and assigned responsibility, rather than a status change alone. An override is an authorised change or rejection of a system proposal under defined conditions, not unrestricted permission to bypass controls.
Judgment-intensive matters should present the proposal and rationale, source evidence, assumptions, alternatives, consequences and unresolved limitations. Retain the information actually reviewed, questions, corrections and resolution. Another AI answer is not automatically independent evidence.
The objective is not to capture every internal model reasoning step. It is to retain a business rationale verifiable against evidence and the accountable person’s decision record.
Monitor signals without premature conclusions
Amounts clustered below approval thresholds, short approval times, no returned items, excessive permissions and ownerless rules are investigation signals, not proof of fraud or absent review. AI can assist screening where data is complete and criteria are tested. Full-population analysis does not remove missing-data or inference risk.
Test unflagged items too, aggregate transactions under applicable criteria and reconcile actual permissions to documents. The objective is decision quality, not an artificial target for returned items.
References and boundaries
COSO connects structure, authority, responsibility and controls. Its 2026 GenAI guidance applies established principles to AI risks. The DOA tables here are DHISORA’s proposals, not mandatory COSO forms or COSO certification [1].
Listed-company related-party transactions require assessment of category, size, aggregation, interested parties and approval levels under applicable rules. Internal DOA cannot remove required steps. Pre-IPO companies can prepare their systems without assuming they already have listed-company status [2].
The Bank of Thailand policy applies to specified financial service providers, not every Thai business [4]. Check signing authority and reserved matters against applicable law, constitutional documents, resolutions and delegations. Adding AI provisions does not create new authority for a person or system.
Executive synthesis: judgment and human oversight
Part 4: process design and controls
Discuss DOA and finance process controls
Published 10 October 2026 by DHISORA Advisory. Initial design guidance, not a legal opinion, system certification or assurance. Adapt implementation to the organisation’s requirements and risks.
Questions to ask yourself
- Which low-value matters need substantial judgment, and who receives them?
- Does each automated rule have an owner, aggregate limits, a review date and stopping conditions?
- What evidence does the approver inspect, and how is the rationale recorded?
- Do system permissions and temporary deputies match the current DOA?
Start with one process. Reconcile DOA with actual system permissions, define evidence and exception requirements, and test whether out-of-scope items are held and escalated before enabling autonomous execution.