What Usual may review
Subject to available system records and approved processes, Usual may review tool access, prompts, uploads, outputs, sharing, edits, publication histories and workflow approvals. An employee should not assume a company AI conversation is private because it looks like a chat. Absence of a retained prompt is not proof that the output was created without one.
Quarterly attestation
Owners confirm that registered uses still match actual practice, restricted inputs are excluded, reviewers are named and material errors have been escalated. A manager cannot attest on behalf of a team solely because its adoption chart looks healthy. The evidence must show a workflow, not a preferred interpretation of a bar graph.
Audit testing
Internal Audit samples web pages, slide decks, customer documents and decisions. Auditors trace material claims to sources and follow AI-generated language through human review. A paragraph is not human-reviewed because the author changed a comma. Review must be capable of changing a conclusion.
Escalation
A pattern of unapproved use, unsupported claims or false attestations moves to Legal, IT Security and the relevant business owner. Records are preserved where needed. The review asks who knew, what left Usual and which decisions relied on it before approving a revised training module.
