Strategy & Metrics (SM) - Processes Domain

HAIAMM Assessment Questionnaire v3.5

Generated from cells/SM-Processes-L*.cell.json. Do not edit by hand. Canonical model: HAIAMM-v3.5-Framing.md · Handbook: HAIAMM-v3.5-Handbook.md.

---

Practice: Strategy & Metrics (SM) Domain: Processes Business Function: Governance Purpose: Stand up governance for business workflows with AI in the decision path, map where AI touches decisions, and baseline the metrics that prove ungoverned AI decisioning is shrinking. Scoring Model: Evidence + Outcome Metrics (see Scoring Methodology below)

---

Instructions

• Answer from current, implemented practice, not plans or aspirations.
• Each question has two components: Evidence (what you did) and Outcome Metrics (how well it worked).
• Levels are derived, never self-assigned. Record evidence and metric values; the level falls out of the scoring below.
• Silence is not a pass. A metric you cannot produce is left blank and counts as not met. Do not estimate.
• Answer progressively. Complete all Level 1 questions before Level 2.

Evidence grade

Record how each answer is known, not only what is claimed (v3.5 framing §6). A level claim is graded at its weakest field.

Grade	Meaning
E0	Asserted by a practitioner, unevidenced
E1	Asserted, with a link to a named artifact
E2	Emitted by a system as telemetry
E3	Machine-attested and independently checkable

---

Scoring Methodology

Tier	Score	Criteria
Fully Mature	1.0	Evidence complete + ≥3 outcome metrics meet targets
Implemented	0.67	Evidence complete + 2 outcome metrics meet targets
Partial	0.33	Evidence partially complete + <2 outcome metrics meet targets
Not Implemented	0.0	No substantive evidence of practice

Practice maturity level achieved = the highest level where all 3 questions score ≥ 0.67.

---

Maturity Level 1, Foundational

Objective: Stand up governance for business workflows with AI in the decision path, map where AI touches decisions, and baseline the metrics that prove ungoverned AI decisioning is shrinking.

Question L1.1: Charter process AI governance and engage business owners

Q1.1: Is there a published charter jointly sponsored by the CISO and a business leader, with the working group constituted around business-process owners and explicit decision rights over introducing AI into a decision path and suspending an AI-enabled process?

Evidence Required:

• [ ] Publish a charter within the first 30 days sponsored by the CISO jointly with the Chief Operating Officer or equivalent business leader, because in this domain a security-only sponsor has no authority over the processes being governed
• [ ] Name the seven in-scope archetypes, being decision pipeline, customer-facing flow, human-in-the-loop chain, back-office augmentation, approval and review workflow, content-generation workflow, and knowledge-management workflow
• [ ] Constitute the working group around business-process owners rather than around technologists, with Security, Compliance, Legal and Privacy counsel, internal audit and one representative per major business function
• [ ] Define decision rights over who may introduce AI into a decision path, who must approve it where the decision affects a person, who can suspend an AI-enabled process, and who owns the fallback when it is suspended
• [ ] Commit to a numeric year-one target per outcome metric, and state explicitly that the program measures decision quality and oversight, not only throughput

Evidence grade for this question: ☐ E0 ☐ E1 ☐ E2 ☐ E3

Answer:

• ☐ Fully Mature (Evidence complete + ≥3 metrics meet targets)
• ☐ Implemented (Evidence complete + 2 metrics meet targets)
• ☐ Partial (Evidence partially complete + <2 metrics meet targets)
• ☐ Not Implemented (No evidence)

Evidence Location: _________________________________

Notes: ___________________________________________

Question L1.2: Map AI decision points and define the unit of work

Q1.2: Does one inventory map every AI-enabled process across the seven archetypes, recording the decision AI contributes, whether it advises or decides, the human oversight arrangement, the affected population, legal or significant effect, and the fallback, at 80% coverage or better against the business process register?

Evidence Required:

• [ ] Build one AI-enabled process inventory recording per process the archetype, business owner, the specific decision or output AI contributes, whether AI advises or decides, the human oversight arrangement including who reviews and with what authority to refuse, volume and throughput, the population affected, whether the decision has legal or significant effect on a person, the fallback when AI is unavailable, and links to the systems that implement it
• [ ] Discover through three mechanisms, since telemetry will not find these: structured workflow-mapping sessions with each business function, reconciliation against the business process register and internal control catalogue, and targeted interviews following the money and the complaints, because an AI-enabled process that has begun generating disputes is usually known to someone
• [ ] For every process, define and record the unit of business work it delivers, being the resolved ticket, the processed application, the reviewed document or the completed transaction
• [ ] This definition is the denominator that makes consumption measurable across the whole model, and no other domain can supply it

Evidence grade for this question: ☐ E0 ☐ E1 ☐ E2 ☐ E3

Answer:

• ☐ Fully Mature (Evidence complete + ≥3 metrics meet targets)
• ☐ Implemented (Evidence complete + 2 metrics meet targets)
• ☐ Partial (Evidence partially complete + <2 metrics meet targets)
• ☐ Not Implemented (No evidence)

Evidence Location: _________________________________

Notes: ___________________________________________

Question L1.3: Baseline the process scoreboard and open the per-transaction ledger

Q1.3: Is a unit of business work defined for every AI-enabled process, and is a per-transaction ledger open recording AI cost per unit against the pre-AI baseline with human review time tracked alongside it?

Evidence Required:

• [ ] Instrument and report quarterly: process inventory coverage against the business process register, the share of AI-enabled processes with a named business owner, the share with a documented and testable human oversight arrangement, the count of processes making decisions with legal or significant effect that lack a documented Art. 22 safeguard, and the share with a defined fallback
• [ ] Open the per-transaction ledger recording AI cost per unit of business work for each process, using the denominator defined in Activity B, and record the pre-AI baseline cost per unit where it is known, because the unit economics of an AI-enabled process against the human process it replaced is the only honest test of whether the transformation delivered what it was funded on
• [ ] Track human review time per transaction alongside AI cost, since a process that halves AI cost while doubling review burden has not improved, and only the combined figure reveals it

Evidence grade for this question: ☐ E0 ☐ E1 ☐ E2 ☐ E3

Answer:

• ☐ Fully Mature (Evidence complete + ≥3 metrics meet targets)
• ☐ Implemented (Evidence complete + 2 metrics meet targets)
• ☐ Partial (Evidence partially complete + <2 metrics meet targets)
• ☐ Not Implemented (No evidence)

Evidence Location: _________________________________

Notes: ___________________________________________

Level 1 Outcome Metrics

Metric	Baseline	Current	Target	Met?	Notes
AI-enabled process inventory coverage against the business process register	___	___	≥80% of in-scope processes within 12 months	☐
AI-enabled processes with a named accountable business owner	___	___	100%	☐
AI-enabled processes with a documented and testable human oversight arrangement	___	___	≥90%, and 100% where the decision affects a person	☐
Decision-affecting processes lacking a documented Art. 22 safeguard	___	___	0	☐
AI-enabled processes with a defined and exercised fallback for AI unavailability	___	___	≥85%, and 100% for customer-facing flows	☐

Where each number is read from:

• AI-enabled process inventory coverage against the business process register — Process inventory reconciled against the business process register
• AI-enabled processes with a named accountable business owner — Process inventory owner field
• AI-enabled processes with a documented and testable human oversight arrangement — Process inventory oversight field
• Decision-affecting processes lacking a documented Art. 22 safeguard — Process inventory cross-referenced with the privacy assessment register
• AI-enabled processes with a defined and exercised fallback for AI unavailability — Process inventory fallback field with last-exercised date

Level 1 Consumption Metrics

Absolute spend is a ledger input, never a metric. Every row is divided by a unit of business work. If AI spend is not allocated to an owning team, record this level as blocked on allocation rather than scoring it down (v3.5 framing §12).

Metric	Denominator	Current	Economic failure it detects	Met?
AI cost per unit of business work, by process, against the pre-AI baseline	per business transaction completed	___	an AI-enabled process costing more per completed unit than the human process it replaced, which absolute spend and throughput reporting both conceal	☐
Combined AI cost and human review time per unit of business work	per business transaction completed	___	cost displaced from AI spend onto human reviewers, so the process looks cheaper while total cost per unit rose and reviewer load quietly became unmanageable	☐
Cost per human-in-the-loop review, with review volume per reviewer	per HITL review	___	oversight degrading into rubber-stamping as review volume per reviewer rises, which is an economic signal before it is a quality signal	☐

Level 1 30-second check (E0)

• ☐ Yes ☐ No — Can you list the business processes where AI now makes or shapes a decision?
• ☐ Yes ☐ No — Does every AI-enabled process have a named business owner?
• ☐ Yes ☐ No — Do you know what one unit of work costs in your AI-enabled processes?

---

Maturity Level 2, Comprehensive

Objective: Tier AI-enabled processes by decision impact and oversight burden, calibrate control intensity per tier, and measure whether human oversight can actually refuse.

Prerequisite cells: SM-Processes-L1, PC-Processes-L1, TA-Processes-L1

Question L2.1: Publish the process risk-tier rubric

Q2.1: Is every AI-enabled process assigned a tier from a published rubric covering decision impact on people, reversibility, throughput, oversight burden and fallback viability, re-derived when volume, population or decision scope changes?

Evidence Required:

• [ ] Derive four tiers from five auditable dimensions
• [ ] Decision impact on people is the dominant dimension: a process producing legal or significant effects under GDPR Art. 22, or falling in an EU AI Act Annex III category such as hiring, credit, education, essential services or law enforcement, is Critical regardless of volume
• [ ] Reversibility elevates where the decision is difficult or impossible to undo once acted upon, which is what separates a rejected application from a drafted email
• [ ] Throughput elevates because scale converts a modest error rate into a material population harm, and because it is the dimension that most reliably degrades oversight
• [ ] Oversight burden elevates where the human review load per reviewer is high enough that meaningful scrutiny is doubtful, which is a property of the process design rather than of the reviewers
• [ ] Fallback viability elevates where there is no workable manual path, since a process that cannot be suspended cannot be governed
• [ ] Publish the rubric and re-derive when volume, population or decision scope changes

Evidence grade for this question: ☐ E0 ☐ E1 ☐ E2 ☐ E3

Answer:

• ☐ Fully Mature (Evidence complete + ≥3 metrics meet targets)
• ☐ Implemented (Evidence complete + 2 metrics meet targets)
• ☐ Partial (Evidence partially complete + <2 metrics meet targets)
• ☐ Not Implemented (No evidence)

Evidence Location: _________________________________

Notes: ___________________________________________

Question L2.2: Calibrate oversight design and control intensity per tier

Q2.2: Does the tier-treatment matrix specify the reviewer's authority, information and time budget numerically for every Critical-tier process, along with escalation criteria, contestability route, testing obligations and fallback exercise cadence?

Evidence Required:

• [ ] Publish a tier-treatment matrix covering per tier: oversight model, ranging from post-hoc sampling through mandatory review before effect to dual review for Critical
• [ ] The reviewer's authority, information and time budget per decision, stated numerically rather than as a principle, because an oversight arrangement that does not specify how long a reviewer has is an arrangement that will be compressed until it is meaningless
• [ ] Escalation path and the criteria that force escalation
• [ ] Contestability and appeal route where the decision affects a person
• [ ] Testing obligations including decision-quality sampling and adversarial review
• [ ] Fallback exercise cadence
• [ ] Add the consumption row: report cost per transaction inclusive of review time per tier, and set a reviewer load ceiling per tier above which the process must be redesigned rather than the reviewers exhorted
• [ ] Treat a volume increase, a population change, a model change or an oversight reduction as a material change triggering re-review, including when the oversight reduction was justified as an efficiency gain

Evidence grade for this question: ☐ E0 ☐ E1 ☐ E2 ☐ E3

Answer:

• ☐ Fully Mature (Evidence complete + ≥3 metrics meet targets)
• ☐ Implemented (Evidence complete + 2 metrics meet targets)
• ☐ Partial (Evidence partially complete + <2 metrics meet targets)
• ☐ Not Implemented (No evidence)

Evidence Location: _________________________________

Notes: ___________________________________________

Question L2.3: Measure whether oversight can refuse, and report per tier

Q2.3: Is human oversight measured continuously per reviewer covering override rate paired with sustained-override rate, review volume against a published ceiling, decision latency against the stated time budget, and escalation precision, and is a sustained near-zero override rate at high volume treated as a finding?

Evidence Required:

• [ ] Instrument the oversight arrangement itself rather than its existence
• [ ] Record per process and per reviewer: review volume per reviewer per day, override or rejection rate, median decision latency, escalation rate and escalation precision, and the proportion of decisions that reach effect without any human touch
• [ ] Report these per tier quarterly alongside inventory state, fallback exercise currency and per-tier service-level adherence
• [ ] A sustained override rate near zero at high volume is the signature of rubber-stamping and should be treated as a finding rather than as evidence of model quality, and the same is true of a decision latency that implies less time per item than reading it would take
• [ ] Pair the override rate with sustained-override rate and escalation precision, because override rate alone is gameable once it becomes a target
• [ ] Maintain a tier-movement log recording the triggering dimension, and review it quarterly with the business sponsor

Evidence grade for this question: ☐ E0 ☐ E1 ☐ E2 ☐ E3

Answer:

• ☐ Fully Mature (Evidence complete + ≥3 metrics meet targets)
• ☐ Implemented (Evidence complete + 2 metrics meet targets)
• ☐ Partial (Evidence partially complete + <2 metrics meet targets)
• ☐ Not Implemented (No evidence)

Evidence Location: _________________________________

Notes: ___________________________________________

Level 2 Outcome Metrics

Metric	Baseline	Current	Target	Met?	Notes
AI-enabled processes carrying a current tier assignment	___	___	100% of mapped processes, with tier age under 12 months	☐
Critical-tier processes whose oversight arrangement specifies reviewer authority, information and time budget numerically	___	___	100%	☐
Critical- and High-tier processes with a fallback exercised within the last 12 months	___	___	100% of Critical, ≥90% of High	☐
Decision-affecting processes with a documented and reachable contestability route	___	___	100%	☐
Per-tier service-level adherence across review, testing, monitoring and issue management	___	___	≥90% per tier	☐

Where each number is read from:

• AI-enabled processes carrying a current tier assignment — Process inventory tier field
• Critical-tier processes whose oversight arrangement specifies reviewer authority, information and time budget numerically — Process inventory oversight specification field
• Critical- and High-tier processes with a fallback exercised within the last 12 months — Fallback exercise log with dates
• Decision-affecting processes with a documented and reachable contestability route — Process inventory cross-referenced with customer-facing appeal channels
• Per-tier service-level adherence across review, testing, monitoring and issue management — Program telemetry from each practice's log

Level 2 Consumption Metrics

Absolute spend is a ledger input, never a metric. Every row is divided by a unit of business work. If AI spend is not allocated to an owning team, record this level as blocked on allocation rather than scoring it down (v3.5 framing §12).

Metric	Denominator	Current	Economic failure it detects	Met?
Cost per completed transaction inclusive of human review time, by tier	per business transaction completed	___	AI cost reductions achieved by displacing work onto reviewers, which reads as efficiency until review burden and total unit cost are reported together	☐
Cost per human-in-the-loop review against the tier reviewer-load ceiling	per HITL review	___	oversight degrading economically before it degrades visibly, as review cost per item is squeezed toward the point where meaningful scrutiny is not purchasable	☐
Assured Spend Ratio for process AI consumption at Critical tier	per dollar of process AI consumption within the tier	___	AI consumption in decision-affecting processes flowing through systems the program has not mapped, which is the highest-consequence form of shadow AI in this domain	☐

Level 2 Oversight Metrics

"A human approves it" is not a control unless you measure whether they refuse. A metric that cannot fail is not a metric.

Metric	Current	Oversight failure it detects	Met?
Override or rejection rate per reviewer, paired with sustained-override rate	___	rubber-stamping, where approval is recorded without review; pairing with sustained-override rate counters the gaming that follows once override rate becomes a target	☐
Review volume per reviewer per day against the tier's published ceiling	___	approver overload, where scrutiny cannot survive the volume regardless of reviewer diligence, which is a process design defect rather than a personnel one	☐
Median decision latency per item against the tier's stated time budget	___	pro-forma approval, where the time taken per item is less than the time required to read it	☐
Escalation rate and escalation precision	___	escalation blindness, where reviewers never escalate, or escalate indiscriminately so that escalation carries no signal	☐

Level 2 30-second check (E0)

• ☐ Yes ☐ No — Does every AI-enabled process carry a risk tier?
• ☐ Yes ☐ No — Do you know how often your reviewers actually reject an AI recommendation?
• ☐ Yes ☐ No — Has any high-impact AI process fallback been exercised this year?

---

Maturity Level 3, Industry-Leading

Objective: Derive process decision mapping and oversight telemetry from live workflow signals, benchmark decision quality and unit economics externally, and compute the transformation return.

Prerequisite cells: SM-Processes-L2, ML-Processes-L2, EG-Processes-L2

Question L3.1: Derive process mapping and oversight state from workflow telemetry

Q3.1: Are decision points and oversight state derived from workflow telemetry at 80% or better against a published objective of detecting a material oversight change within 5 business days, with processes on non-emitting systems listed explicitly rather than assumed covered?

Evidence Required:

• [ ] Instrument the workflow and case-management systems to emit the facts the inventory needs, rather than re-collecting them by interview
• [ ] Emit per decision: which step invoked AI, whether the output was accepted, modified or rejected, which reviewer acted, how long they took, whether the decision reached effect without human touch, and whether it was later contested or overturned
• [ ] From this, derive tier inputs continuously, since volume, population and oversight burden all change without anyone filing a change request
• [ ] Publish a data-quality objective covering detection of a material oversight change within 5 business days, which is the interval that matters because oversight degrades gradually rather than abruptly
• [ ] Wire tier increases to open downstream obligations automatically
• [ ] Reserve human curation for processes spanning systems that cannot emit telemetry, which will remain a real category in most organizations and should be recorded as such rather than quietly assumed covered

Evidence grade for this question: ☐ E0 ☐ E1 ☐ E2 ☐ E3

Answer:

• ☐ Fully Mature (Evidence complete + ≥3 metrics meet targets)
• ☐ Implemented (Evidence complete + 2 metrics meet targets)
• ☐ Partial (Evidence partially complete + <2 metrics meet targets)
• ☐ Not Implemented (No evidence)

Evidence Location: _________________________________

Notes: ___________________________________________

Question L3.2: Benchmark decision quality and oversight effectiveness externally

Q3.2: Does the semi-annual benchmarking brief compare override rate, reviewer load and contested-and-overturned rate by decision type against a named peer cohort, acknowledging that the provisional oversight thresholds require cross-organization calibration per decision type?

Evidence Required:

• [ ] Publish a semi-annual brief comparing the program against named peers on at least five metrics: process coverage, override rate by decision type, reviewer load against ceiling, contested-and-overturned rate, and cost per transaction inclusive of review
• [ ] Benchmarking matters more here than anywhere else in the model because the provisional oversight thresholds are exactly that, provisional, and almost certainly vary by decision type: an override rate that indicates healthy scrutiny in credit adjudication may indicate a broken model in content moderation
• [ ] Only cross-organization comparison for the same decision type can calibrate them, which is why contributing data matters as much as consuming it
• [ ] Draw from sector bodies, regulatory working groups where they exist for the decision type, professional associations for the relevant function, and the FinOps Foundation for unit economics
• [ ] Name the cohort, defend its selection, and publish where the program trails

Evidence grade for this question: ☐ E0 ☐ E1 ☐ E2 ☐ E3

Answer:

• ☐ Fully Mature (Evidence complete + ≥3 metrics meet targets)
• ☐ Implemented (Evidence complete + 2 metrics meet targets)
• ☐ Partial (Evidence partially complete + <2 metrics meet targets)
• ☐ Not Implemented (No evidence)

Evidence Location: _________________________________

Notes: ___________________________________________

Question L3.3: Compute the transformation return and contribute oversight methods

Q3.3: Is the transformation return computed as fully loaded cost per completed transaction including review and rework against the pre-AI baseline, published annually including unfavourable results, and reconciled with Finance?

Evidence Required:

• [ ] Compute the return honestly from the per-transaction ledger against the pre-AI baseline captured at L1, covering: change in fully loaded cost per completed transaction including review time and rework, not AI spend alone
• [ ] Change in decision quality measured as contested-and-overturned rate
• [ ] And avoided loss from contained decision-quality incidents
• [ ] Report the result even when it is unfavourable, because a process whose fully loaded unit cost rose after AI enablement is a finding the organization needs and will not get from a throughput dashboard
• [ ] Reconcile with Finance annually
• [ ] Separately, contribute at least four externally accepted artifacts per year weighted toward the calibration problem: oversight design patterns with measured outcomes, override-rate and reviewer-load data by decision type contributed to sector bodies and regulatory consultations, contestability and appeal route patterns, and EU AI Act Art. 14 human oversight implementation guidance
• [ ] Anonymize and legally vet every submission

Evidence grade for this question: ☐ E0 ☐ E1 ☐ E2 ☐ E3

Answer:

• ☐ Fully Mature (Evidence complete + ≥3 metrics meet targets)
• ☐ Implemented (Evidence complete + 2 metrics meet targets)
• ☐ Partial (Evidence partially complete + <2 metrics meet targets)
• ☐ Not Implemented (No evidence)

Evidence Location: _________________________________

Notes: ___________________________________________

Level 3 Outcome Metrics

Metric	Baseline	Current	Target	Met?	Notes
Process decision points and oversight state derived from workflow telemetry rather than interview	___	___	≥80% telemetry-derived, with the non-emitting remainder explicitly listed	☐
Time to detect a material oversight change	___	___	≤5 business days at the 90th percentile	☐
Peer-comparable metrics in the semi-annual brief, including override rate by decision type	___	___	≥5 metrics with a named and defended peer cohort	☐
Fully loaded cost per completed transaction against the pre-AI baseline	___	___	computed and published per process annually, including where the result is unfavourable	☐
Externally accepted oversight and decision-quality contributions per year	___	___	≥4 accepted, weighted toward threshold-calibration data	☐

Where each number is read from:

• Process decision points and oversight state derived from workflow telemetry rather than interview — Workflow telemetry pipeline joined to the process inventory
• Time to detect a material oversight change — Oversight telemetry change-detection log
• Peer-comparable metrics in the semi-annual brief, including override rate by decision type — Published benchmarking brief
• Fully loaded cost per completed transaction against the pre-AI baseline — Per-transaction ledger joined to workflow review-time and rework telemetry
• Externally accepted oversight and decision-quality contributions per year — Contribution log with external acceptance references

Level 3 Consumption Metrics

Absolute spend is a ledger input, never a metric. Every row is divided by a unit of business work. If AI spend is not allocated to an owning team, record this level as blocked on allocation rather than scoring it down (v3.5 framing §12).

Metric	Denominator	Current	Economic failure it detects	Met?
Fully loaded cost per completed transaction against the pre-AI baseline, including review and rework	per business transaction completed	___	an AI-enabled process that is cheaper in AI spend and more expensive overall once review time and rework are counted, which throughput and spend dashboards both conceal	☐
Cost per completed transaction benchmarked against the peer cohort for the same process type	per business transaction completed	___	an internally improving unit cost that remains well above what peers achieve, which internal trend lines are structurally unable to reveal	☐
Avoided loss from contained decision-quality incidents	per contained incident	___	decision-quality drift running long enough to affect a material population, where time to detect is the whole of the harm	☐

Level 3 Oversight Metrics

"A human approves it" is not a control unless you measure whether they refuse. A metric that cannot fail is not a metric.

Metric	Current	Oversight failure it detects	Met?
Override rate by decision type, benchmarked against the peer cohort for that decision type	___	rubber-stamping judged against a universal threshold that does not fit the decision type, which either masks a broken oversight arrangement or condemns a healthy one	☐
Oversight degradation detection latency	___	oversight eroding gradually as volume grows or staffing changes, which no periodic assessment catches because each individual month looks like the last	☐
Contested-and-overturned rate, per tier and decision type	___	oversight that records approvals at healthy rates while the decisions it approved are being reversed downstream, which is the outcome measure that override rate only proxies	☐

Level 3 30-second check (E0)

• ☐ Yes ☐ No — Does your oversight data come from the workflow system or from a survey?
• ☐ Yes ☐ No — Would you notice within a week if reviewers stopped rejecting anything?
• ☐ Yes ☐ No — Do you know whether AI made your process cheaper once review time is counted?

---

Summary Scorecard

Level	Q1	Q2	Q3	Level score	Weakest evidence grade	Achieved?
L1	___	___	___	___	___	☐
L2	___	___	___	___	___	☐
L3	___	___	___	___	___	☐

Strategy & Metrics (SM) maturity in the Processes domain: ____________

---

Document Version: HAIAMM v3.5 (generated)