Map every policy requirement to the procedure steps that deliver it, and treat anything unmapped as a gap. An agent does this mapping well: it reads the policy and its procedures, links each "must" to a step, and drafts a gap list with reasons. The policy owner confirms the gaps, and the procedure owner fixes them.
What is the check, and who owns it?
A policy says what must happen. A procedure says how people, and increasingly agents, actually do it. Over time the two drift: a policy is updated after a regulatory change and the procedure is not, or a team improvises a workaround that becomes the real process. The check finds the drift before a supervisor or an auditor does.
It is usually owned by the compliance function as part of monitoring, with each policy owner accountable for their policy and each procedure owner for their procedure. The check matters more once agents run parts of the process, because your procedures are now the agent's instructions. A gap that a careful person would have bridged with common sense becomes behaviour an agent will repeat on every case.
What does the agent prepare, step by step?
- Person, compliance: sets the scope. Which policy, which procedures, which business units, and the versions to use.
- Agent, depth 1: extracts requirements from the policy. Every obligation, prohibition, threshold, approval and timing, each with its clause reference. It distinguishes "must" from "should".
- Agent, depth 1: extracts steps from the procedures. Each step, who performs it, the system used, the record it leaves and any thresholds.
- Agent, depth 1: maps requirements to steps. Each requirement is linked to the step or steps that deliver it, with a short reason. Requirements with no step are gaps; steps that contradict a requirement are conflicts.
- Agent, depth 2: drafts the findings. Gaps, conflicts, threshold mismatches, missing approvals and missing records, each with the clause, the step and a suggested fix.
- Person, policy owner: confirms or rejects each finding. Some apparent gaps are covered by another procedure or a system control the agent could not see.
- Person, procedure owner: agrees the fix and the date. The agent may draft revised wording, but the owner decides it.
- Agent, depth 1: re-runs the map after the fix and attaches the result to the finding before it is closed.
| Step | The agent does | Depth | Stays with a person |
|---|---|---|---|
| Scope | Nothing | None | Choosing policies and versions |
| Requirements | Extracts each with its clause | 1 | Agreeing the list |
| Steps | Extracts each with owner and record | 1 | Saying what really happens |
| Mapping | Links requirements to steps | 1 | Judging coverage |
| Findings | Drafts gaps and conflicts | 2 | Confirming each finding |
| Fix | Drafts wording if asked | 2 | Deciding the fix |
| Retest | Re-runs the map | 1 | Closing the finding |
Which controls keep the check honest?
Versions fixed at the start. The agent works from named versions of the policy and the procedures, pulled from the library, and records them. Linking to a versioned policy library makes this automatic. Evidence: version stamps on every finding.
Clause-to-step traceability. Every mapping row cites both ends. A reviewer can test any line in a minute. Evidence: the full requirement-to-step matrix, kept with the review.
Owner decisions recorded. A rejected finding needs a reason, such as "covered by system control X". Evidence: a decision log that shows who rejected what, which an auditor will sample.
Retest before closure. A finding closes only when the re-run map shows the gap filled. Evidence: the before and after maps.
What should you measure?
- Findings confirmed versus rejected by owners. A high rejection rate usually means the agent cannot see system controls; give it the control register.
- Gaps found by audit or a supervisor after a clean check. This is the real test.
- Time to fix confirmed findings, by owner.
- Procedures with no owner or no review date, which the extraction surfaces as a side effect.
- Conflicts between procedures, where two teams carry out the same task in different ways under one policy, which often explains inconsistent outcomes for customers.
Where does it usually go wrong?
Checking the written procedure, not the real one. A procedure document can match the policy perfectly while the team does something else. Pair the document check with sampled evidence from the system of record, such as approvals actually given. Where the two disagree, the finding is about practice, and the procedure owner must say which one reflects how the work should be done.
Thresholds in different units. The policy says "above the customer's limit" and the procedure gives a fixed amount; or one uses gross values and the other net. The agent should flag every threshold pair it cannot reconcile exactly, not assume they agree.
Approvals that exist in name only. The procedure says "manager approves" but names no role and leaves no record. That is a gap even when approval happens in practice.
Agent instructions left out. If an agent performs part of the procedure, its brief is part of the procedure. Include it in the scope. Where one agent checks another's brief, the questions in whether one AI agent can check another's work apply.
The same mapping method works for other checks against an approved baseline, such as checking spend against approved budgets. Where this fits in the compliance function overall is covered in AI compliance agents.
Questions people ask
How often should procedures be checked against policy?
At every material policy change, and on a cycle set by risk for the rest. With an agent doing the mapping, a full check after each policy change becomes practical rather than aspirational.
Can the agent rewrite the procedure to close a gap?
It can draft replacement wording tied to the clause it serves. The procedure owner decides whether to adopt it, because only they know how the work is really done.
What if two policies conflict with each other?
The agent reports the conflict with both clauses quoted. Resolving it belongs to the policy owners, and often to a committee, not to the agent or to the procedure owner.