Practical guide · Jonathan Malchow Vega
Turn one policy sentence into a working practice
Connect a rule to its trigger, responsible person, action, and evidence.
Choose a rule with a real trigger
A policy can state an intention without explaining how someone acts on it. Start with one sentence and identify the event that makes it relevant. “Review new tools before use” becomes more workable when the trigger is “a colleague requests access to a tool not already listed in the approved inventory.”
Worked example: a new tool request
This fictional example is not a client case study. A colleague asks to use a transcription service. The request goes to a named owner before any recording is uploaded. The owner asks what material would be processed, who would receive access, and what terms need review. If those facts are missing, the request remains unresolved; silence is not approval.
Describe the action and record
The practice needs a request record, a decision maker, an outcome, and the reason. Record the scope of an approval, any conditions, and where the evidence can be found. If the organization requires specialist review, identify that step and its owner. A template does not supply authority that the person completing it does not have.
Test an exception
What happens if a colleague already uploaded a recording? That is a different trigger. Record what is known, notify the appropriate owner, and follow the organization’s incident process. Do not quietly rewrite the request date to make the sequence appear compliant. The example shows why the normal path and the exception path both need an owner.
Check whether the practice happened
Choose one recent request and follow it from trigger to outcome. Can you find the decision and its conditions? Can the operator explain which material was permitted? A completed form is evidence that a form exists. It takes further checking to establish whether the actual use stayed within the decision.
Source and scope
NIST AI Risk Management Framework. NIST provides a voluntary framework for managing AI risk. This article offers an independent working example, not a NIST assessment, certification, or complete implementation.