Your AI Intern Just Started. Who's Supervising It?
The proposal looked right.
Clean formatting. Confident tone. Data that felt solid enough to stand
behind.
Then the client asked a simple question.
"Can you show me where these numbers came from?"
That's where things break.
Not because someone made a careless mistake.
Because no one defined what "done" looks like when AI is involved.
This Is Already Happening Inside Firms
We're seeing this show up quietly across CPA firms:
- Email drafting
that skips a second look
- Proposals built
on AI-generated research
- Financial
summaries formatted and rewritten by AI
- Internal
reporting cleaned up by tools no one approved
None of these are bad uses.
The issue is there's no structure around them.
From the outside, that doesn't look like efficiency.
It looks like a lack of internal control.
How This Fails in Real Firms
Here's how this typically unfolds.
Step 1: Staff uses AI to speed up research or draft a proposal
Step 2: The tool generates content that sounds credible
Step 3: Sources aren't documented because it "looked right"
Step 4: Reviewer assumes accuracy and focuses on formatting or tone
Step 5: Deliverable goes to the client
Then comes the moment that matters.
The client asks for validation.
Now a partner gets pulled in.
The team retraces steps.
The original source can't be verified.
What That Actually Costs
This isn't a technical failure. It's an operational one.
In practice, we see:
- 2-4 hours of
rework to rebuild and verify the output
- Partner-level
escalation that shouldn't have been needed
- Delayed
deliverables while the team corrects the issue
- A subtle but
real hit to credibility in front of the client
No breach. No malware.
Just a breakdown in how work is reviewed.
From an audit or client perspective, undocumented AI-assisted output
looks like weak internal control.
AI Doesn't Break Processes. It Exposes Them
AI is very good at making incomplete processes look finished.
If a step is missing — documentation, validation, ownership — AI will
move right past it.
And because the output is polished, the gap becomes harder to see.
That's the risk.
Not that AI is wrong.
That it can be wrong in a way that looks right.
The AI Supervision Framework (With Enforcement)
You don't need a complex policy. You need something clear enough that
people actually follow it.
Here's a working model.
1. Approved Tools List
Where it lives: Shared internal document or intranet page
What it includes: Every AI tool your firm allows
Rule: If it's not on the list, it's not used.
2. Data Boundaries
What's explicitly restricted:
- Client names
- Financial data
- Contracts
- Employee
information
Rule: No sensitive data enters a consumer AI platform.
Enforcement: Violations are documented and addressed like any other
policy breach.
3. Human Review Requirement
Every AI-assisted output must be reviewed before it leaves the firm.
How it's tracked:
- Simple checkbox
in workflow
- Note in the
file
- Reviewer
initials
Not complex. Just visible.
4. Use-Case Clarity
Approved uses:
- Drafting
internal documents
- Summarizing
non-sensitive content
- Outlining ideas
Restricted uses:
- Final client
deliverables without review
- Financial
reporting
- Anything
containing confidential data
5. Ownership
One person owns AI usage firm-wide.
Not IT in general. Not "the team."
A named owner responsible for:
- Updating the
tool list
- Maintaining the
policy
- Answering
questions
That ownership restores control.
How to Implement This in One Week
This doesn't need to drag out.
Day 1: Inventory
List every AI tool currently being used across your team.
Day 2: Identify Gaps
Highlight tools that were never formally approved.
Day 3: Define Boundaries
Write down what data is off-limits. Keep it simple and explicit.
Day 4: Assign Ownership
One person. Clear accountability.
Day 5: Write the Policy
One page is enough. Focus on:
- Approved tools
- Restricted data
- Review
requirement
Day 6-7: Communicate and Enforce
Walk the team through it.
Explain:
- Why this
matters
- What changes
- What happens if
it's ignored
Not as a warning. As clarity.
What to Do Next Week
Use one team meeting to make this real.
Meeting Agenda:
- What AI tools
are you actually using today?
- Where are you
using AI in client-facing work?
- Are you
documenting sources or relying on output?
- Who is
reviewing AI-assisted work before it goes out?
- What data have
we already put into these tools?
Expected Output:
- A visible list
of tools
- A short list of
risks specific to your firm
- One owner
assigned
- A draft policy
started
That single meeting gives you control quickly.
Final Thought
You've already built something clients trust.
The risk isn't using AI.
It's using it in a way you can't explain when someone asks.
And eventually, someone will ask.
Next Step
Schedule your 10 minute discovery call to walk through how AI is
currently being used inside your firm and where gaps may exist. 911 IT can help
you validate whether your current approach would hold up under client or audit
scrutiny, and what simple controls would close those gaps.
