Understand controls
Controls are safeguards used to manage an identified risk or meet a governance requirement.
A control contributes to approval or residual-risk decisions only when the required work and evidence are current. Read its purpose, owner and evidence requirements before relying on its status.
What to do
- Open the AI use Governance tab or a Risk Treatment tab.
- Review each control’s purpose, owner, stage, status and available evidence.
- Open the linked action when one is available.
- Use Risk treatment to add a recommended control when it applies.
What happens next
Controls contribute to remaining-risk and approval decisions only when their evidence and effectiveness decision are current.
Complete a control assignment
A control assignment asks a named person to carry out or confirm a safeguard and provide the evidence needed for review.
The practical work may happen inside another system or business process. Record the approved evidence or reference in Swell so the reviewer can understand what was completed.
How to complete a control assignment
- Open the Control assignment owner item from My actions.
- Read the control, AI use or Risk context and required outcome.
- Complete the real-world control work outside or inside Swell as appropriate.
- Record the requested evidence or reference.
- Move the assignment to the next available review or completion step.
Important: Exact Control assignment controls depend on the active record. If the action does not provide a completion control, follow the linked AI use/Risk and request help rather than inventing a workaround.
What happens next
The control status and evidence become available to risk and approval reviewers.
Common situations
- If the control cannot be completed by the original date, coordinate a new plan through the normal governance process and update the available assignment information. Do not mark incomplete work as complete.
- If evidence is stored in another records system, provide an approved reference or link and retain the source evidence under that system’s access and retention rules.
Review control evidence and effectiveness
Evidence shows that the control has been implemented. Effectiveness considers whether it is working well enough for this risk and AI use.
Check that the evidence is relevant and current before confirming effectiveness. If the control stops working or its evidence expires, withdraw the effectiveness decision and review the residual risk.
How to review control evidence and effectiveness
- Open the linked Risk or control record.
- Review the implementation evidence and its currency.
- When authorised, confirm whether the control is effective for that Risk.
- If the control is not effective, use the available action to withdraw effectiveness and record the next work.
- Recalculate the remaining risk when its recognised controls or evidence change.
What happens next
The risk shows whether its remaining-risk rating is current or needs to be recalculated.
Review an approval brief
The approval brief brings together the information an approver needs to decide whether the AI use may proceed and under what conditions.
Review the purpose, assessment, risks, controls, specialist conclusions and unresolved blockers. Being able to see an approval does not necessarily mean you are the person authorised to decide it.
How to review an approval brief
- Open the Approval requirement from My actions or the AI use.
- On Review, read what is being approved, your authority and the decision guide.
- Open Supporting information.
- Review the purpose, risk ratings and treatment, any risk acceptance, controls, specialist conclusions and blockers.
- Do not record a decision until the page says the requirement is ready and you are the assigned approver.
What happens next
When ready, Record final decision opens the decision section.
Assign, reassign or recall an approver
Assign the approval to a person with the authority and independence required for the decision.
Reassign it when the approver is unavailable or the decision belongs elsewhere. Recall the assignment when it should no longer be acted on; these coordination actions do not change the evidence or approval requirement.
How to assign, reassign or recall an approver
- On an unassigned approval, use Assign this approval or Assign approver.
- Choose a compatible organisation member or invite the required person.
- Confirm the assignment.
- Use Reassign approver when the requirement remains valid but another person should decide.
- Use Recall assignment to remove the current approver while keeping the requirement outstanding.
What happens next
The named approver receives the action. Assignment never grants broader organisation authority.
Common situations
- Swell excludes incompatible people where separation-of-duties rules apply.
- If the approver is on leave, reassign the decision to another authorised person rather than recording a decision on their behalf.
- If the approver leaves the organisation, suspend their access through the administration process and reassign any open approval work.
- If there is a conflict of interest, follow the organisation’s conflict process and assign an independent authorised approver.
Record the approval decision
The final approval records whether the AI use may proceed, may proceed with conditions, or is rejected. It should be made only when the decision brief is ready and the assigned person has the required authority.
Explain the reasoning and any limits clearly. Approval records an organisational decision based on the information available at the time; it does not guarantee compliance, safety or the absence of risk.
How to record the approval decision
- Confirm the approval says Ready for decision and has no outstanding specialist confirmations or governance blockers.
- Select Record final decision.
- Choose Approve, Approve with conditions or Reject.
- Enter the rationale. Rationale is required for conditional approval and rejection.
- For conditional approval, add each condition, owner and due date requested by the form.
- Set a validity period when appropriate and submit the decision.
What happens next
Swell records the decision, validity and conditions. Risk acceptance remains a separate decision.
Common situations
- Committee approval: The committee considers the decision through its normal governance process. The authorised chair or representative records the decision in Swell on the committee’s behalf, identifies the committee and meeting/reference in the rationale, records any conditions, and retains meeting evidence through the organisation’s normal records process. Swell does not provide multi-person committee voting.
- For a pilot-only approval, state the permitted scope, users, period and conditions clearly so it is not mistaken for approval of wider deployment.
- For an approval made before Swell was introduced, retain the original decision evidence through the organisation’s records process and record only what the current workflow supports. Do not recreate a historical decision as though it were made today.
- If a committee asks for more information, obtain and retain that information before the authorised representative records the final committee decision.
Complete an approval condition
An approval condition records work that must be completed as part of a conditional decision.
Read the condition, owner, due date and evidence expected. Completing a condition does not replace any separate control, reassessment or monitoring work that is also required.
How to complete an approval condition
- Open the Approval Condition owner action.
- Read the condition, owner, due date and related approval.
- Complete the real-world work.
- Add the available evidence or reference.
- Move the condition to its review or completed state.
What happens next
The condition remains visible with the approval until resolved.
Common situations
- If the named owner becomes unavailable, use the available coordination action or ask an Organisation Administrator to help identify the right replacement.
Complete reapproval after a material change
Reapproval is a fresh decision after a material change, reassessment or incident affects the information or reasoning behind an earlier approval.
Review the changed facts and updated governance work rather than relying on the previous decision. The earlier approval remains in history; the new decision records whether and how the AI use may continue.
How to complete reapproval after a material change
- Open the reapproval requirement created by the material-change review or reassessment.
- Compare the changed facts with the information and reasoning behind the earlier approval.
- Review the updated assessment, Risks, controls and specialist confirmations.
- Resolve blockers and assign the approver.
- Record the new decision and any conditions.
What happens next
The new approval is preserved as a separate decision; earlier decisions remain in history.