Preparing for a smoother audit in Togo
How long an audit takes is rarely decided during the audit. It is decided in the six weeks before it.
Artificial intelligence
A responsible AI checklist for finance leaders
Your teams are probably already using AI. The question is not whether to allow it, but on what terms.
AI adoption in an organisation rarely arrives by decision of the executive committee. It arrives via one person under time pressure pasting a ledger extract into a consumer tool. A usage policy therefore always comes after the fact — which is no reason not to write one.
The nine points to settle
- Purpose. What specific problem is the tool being used for? A use with no defined purpose cannot be controlled.
- Data. Which categories of data may be submitted, and which never may? Name them explicitly: personal data, client data covered by professional secrecy, remuneration data.
- Hosting. Where does the data travel and where is it stored? Togo's Law 2019-014 on personal data protection applies to transfers, including technical and unintended ones.
- Accountability. Who answers for the output? The answer can never be "the tool".
- Review. What level of human verification is required before an output leaves the organisation? Separate exploratory internal use from deliverables going to third parties.
- Traceability. Do you keep a record of what was asked and what came back? Without logging, no after-the-fact review is possible.
- Accuracy. How do you detect an answer that is wrong but plausible? Build in a consistency check against a known sample.
- Bias. Does the tool feed a decision affecting people — hiring, credit, supplier scoring? The bar is not the same in that case.
- Exit. What happens if the provider changes its terms or discontinues the service? An undocumented dependency is an operational risk.
The special case of regulated professions
For an audit or accounting firm, professional secrecy is not a contractual preference: it is an ethical obligation. No identifiable client data should be submitted to a public tool without the client's written authorisation and enforceable confidentiality safeguards. That is the rule we apply to our own work.
Start small, but start in writing
A one-page policy that is applied beats a forty-page framework that is ignored. Write down what is allowed, what is forbidden, and who decides in case of doubt — and have people sign it.