Approved Use Cases and Human Review for SOC 2

What this control should accomplish

AI use is limited to approved purposes, and consequential outputs or actions receive a defined human decision before they affect customers or operations.

How to implement Approved Use Cases and Human Review

1. 1

   Approve the use case

   Document intended users, allowed decisions, prohibited uses, input data, output destination, and accountable owner before launch.

   You should end up with: Signed use-case decision

2. 2

   Define the human decision

   State which outputs require review, reviewer qualifications, information presented, approval choices, and escalation conditions.

   You should end up with: Human-review procedure and decision criteria

3. 3

   Enforce the review point

   Prevent covered output or actions from continuing until the designated reviewer records a decision.

   You should end up with: Workflow gate with attributable decision log

4. 4

   Assess actual use

   Compare workflow activity with approved purposes and review approvals, rejections, overrides, and missed escalations.

   You should end up with: Use-case and reviewer performance review

Evidence to keep, and what it should prove

Build the evidence set in three layers: what defines the control, who approved or reviewed it, and what proves it operated. Collect operating records when the work happens so they remain dated, attributable, correctly scoped, and traceable to the underlying activity.

Before sharing, remove unrelated personal or customer data, never expose passwords, tokens, or secret values, preserve enough source context to authenticate the record, and use the secure exchange approved for the engagement.

Which records should you prepare for the audit?

How an auditor may test this control

Use this checklist to prepare for procedures an auditor may perform. The exact steps and sample selection depend on your engagement scope and the service auditor's professional judgment.

• Confirm the intended control outcome

  Determine whether the control is designed to achieve this result: AI use is limited to approved purposes, and consequential outputs or actions receive a defined human decision before they affect customers or operations.

• Confirm ownership and operating cadence

  Compare the documented owner with the intended role (AI Workflow Owner / CISO / Engineering), then compare dated records with the stated cadence: Per workflow/change; review at least annually.

• Establish the complete audit record set

  Reconcile review-queue records to all runtime outputs and actions matching configured triggers, then compare completed approvals with customer-facing messages and executed actions. Separately reconcile every annual review due date from the schedule to a completed no-change or change decision, a documented missed review, or a rescheduled review that preserves the original and new due dates.

• Prepare the as-of-date evidence for a Type 1 engagement

  Retain current approved use cases and human-review rules, the latest scheduled annual review and its disposition, plus one recent covered output showing the enforced review and final decision on the selected date.

• Prepare period evidence for a Type 2 engagement

  Export every runtime output or proposed action during the period that met a human-review trigger, including approvals, corrections, rejections, escalations, timeouts, cancellations, and any bypass attempt; include every use-case or review-rule change and every scheduled annual use-case and human-review effectiveness review, including no-change completions, missed reviews, and rescheduled reviews.

• Inspect the policy / design artifacts

  Documents that define the control, its scope, ownership, and expected way of working.

  • Inspect human review requirements

    For each selected record, confirm it demonstrates Consequential outputs have explicit review triggers, qualified reviewers, decision criteria, escalation routes, and enforced release gates.

    • Covered output or action
    • Trigger
    • Reviewer role
    • Decision criteria
    • Escalation path
    • Enforcement point

• Inspect the approval / review evidence

  Records showing that an accountable person reviewed, approved, challenged, or accepted the work.

  • Inspect Use case approvals

    For each selected record, confirm it demonstrates The AI workflow is operating for a defined purpose, audience, data scope, and decision boundary approved by an accountable owner.

    • Use-case ID
    • Workflow ID
    • Allowed and prohibited purposes
    • Data scope
    • Approver
    • Decision and date

  • Inspect reviewed output records

    For each selected record, confirm it demonstrates Covered runtime outputs were actually reviewed and resulted in attributable approval, correction, rejection, or escalation before effect.

    • Execution or output ID
    • Workflow version
    • Reviewer
    • Review timestamp
    • Decision
    • Released or corrected result

• Trace the control from design to operation

  Use the categories that apply to this control: connect any policy or design artifact to its approval or review record, then trace a selected operating record through execution, result, and any exception or remediation.

Common implementation and evidence gaps

• Human review is described in policy but the workflow can bypass it.
• Reviewers see the generated answer without supporting context or evidence.
• The approved use case expands quietly through prompt or product changes.
• Approval logs do not identify the reviewer or final decision.

Before you call this control ready

• Can a covered output reach a customer without a recorded decision?
• Do reviewers know when to reject or escalate an output?
• Can recent activity be tied to an approved use case and owner?
• Are rejection and override patterns reviewed for workflow changes?

Trust Services Criteria references

These identifiers help you navigate related Trust Services Criteria. They do not reproduce the criteria or prove that this control fully addresses them in your environment.

• CC5.1
• CC8.1
• P8.1

Confirm final scope, mappings, and testing expectations with your service auditor. SOC 2® is an AICPA trademark; GreenHat Security is not affiliated with or endorsed by AICPA.

Related controls to review next