Active

Human Review of Automated Results

Where automated or AI-assisted relevance scoring is used, the organization shall require appropriate human review and maintain controls to address false positives, false negatives, model limitations, and source-data changes.

Requirement ID
REG-002-R006
Parent Control
REG-002
Domain Code
REG

Requirement Details & Guidance

REG-002-R006 · REG-002
Why This Requirement Exists

This requirement exists to identify relevant regulatory developments promptly and support complete, consistent, and auditable regulatory intelligence.

Implementation Guidance

Define authoritative sources, monitoring frequency, accountable roles, relevance criteria, triage thresholds, alerting, evidence requirements, and human review. Integrate monitoring with the obligations library and regulatory change workflow.

Practical Application & Audit Readiness

REG-002-R006 · Field Guidance

Business Examples

    Common Audit Findings

      Common Mistakes

        Best Practices & Ownership

        REG-002 · Recommended Approach

        Recommended Practices

          Typical Owner

          Cross-Mapped Regulatory Frameworks

          Harmonized Control Mappings
          FRAMEWORK CODE FRAMEWORK NAME & DETAILS FAMILY / CATEGORY VERSION ACTION
          COBIT2019 COBIT COBIT is an enterprise governance and management f... Clause: 4.5 – Monitor, Evaluate and Assess (MEA) > MEA03 – Managed Compliance With External Requirements > MEA03.01 – Identify external compliance requirements.; 4.5 – Monitor, Evaluate and Assess (MEA) > MEA02 – Managed System of Internal Control > MEA02.01 – Monitor internal controls.
          COBIT
          Governance Framework
          		 v2019 View →
          ISO22301 ISO/IEC 22301 ISO 22301 specifies requirements for a Business Co... Clause: 6.1.1 – Determining risks and opportunities, 6.1.2 – Addressing risks and opportunities
          ISO
          Standard
          		 v2019 View →

          Parent Domain Context

          Governance Domain Baseline
          Domain Name:
          Regulatory Change Management (REG)
          Purpose:
          To systematically identify, track, and assess changes in relevant laws and regulations to ensure the organization remains compliant.
          Scope:
          Enterprise
          View

          Parent Control Context

          Control Baseline
          Control Name:
          Automated Regulatory Monitoring & Intelligence (REG-002)
          Summary:
          Establishes automated monitoring of authoritative federal, state, national, and international regulatory sources, with filtering, relevance assessment, alerting, and human review of potentially applicable changes.
          Business Description:
          Monitor authoritative regulatory sources across relevant jurisdictions and identify, collect, and triage regulatory updates using automated monitoring and relevance-scoring capabilities.
          View