AI Guides › Judgement & Guardrails

The One Audit Worth Running On Anything AI Touches At Work

Name: JulieMango AI Agent Marketplace Plans
Brand: JulieMango

By Nigel Guy · 2 min read

AI tools tend to arrive in a workplace one at a time, adopted individually by whoever found them useful, plugged into whatever task was in front of them that week. Nobody sits down and decides the overall footprint. Which means, months later, there's usually no single person who could actually answer "everywhere AI touches our work, what goes in, and who checks what comes out" — until something goes wrong and everyone realises that question should have had an owner.

The rule: build one map of everywhere AI touches your actual work, once, and keep it current — the risk isn't any single tool, it's the sprawl nobody has looked at all at once.

The mechanism: the touchpoint map

Build a simple table, one row per tool or workflow:

Tool / workflow	What data goes in	What the output is used for	Who reviews before it's acted on	Reversible if wrong?
e.g. drafting client emails	client names, correspondence history	sent directly or lightly edited	—	usually not
e.g. meeting summaries	full transcript	shared with the team	one person skims it	mostly

List every AI tool actually touching real work — not just the official ones; the ad hoc ones people adopted individually count too, and are usually where the gaps are.
For each, note what data goes in. This is where sensitive material turns up in places nobody flagged it.
Note what the output is used for downstream, specifically — internal note, client-facing document, a number that feeds a decision.
Note who reviews the output before it's acted on. A blank answer here is the finding, not an oversight in the audit.
Flag every row where review is blank and the output is client-facing, financial, or otherwise consequential. That's your actual priority list, not the tools themselves.

What to skip

Skip trying to audit every personal, low-stakes individual use of AI across the team — that's not proportionate and it isn't what causes incidents. Focus on where the output leaves your control: client communication, published content, financial figures, anything feeding a decision someone else relies on. Skip treating this as a one-off exercise too; a map from a year ago is a map of a different set of tools.

Guardrails

This is a map, not an indictment — the point is visibility, not proving that anyone did anything wrong.
Re-run it whenever a new tool gets adopted broadly, not on a fixed calendar alone — the sprawl grows between scheduled reviews.
This surfaces where review is missing; it doesn't tell you what the right review process should be for each row. That's a separate, more detailed decision for whoever owns each workflow.

All 751 AI guides · JulieMango plans from £17/mo