People. Process. Technology. + AI.

The People, Process, Technology framework remains useful because each part depends on the other two.

Technology fails when people cannot use it. A process without supporting systems creates more administration. Skilled people inside a fragmented process spend their time compensating for the gaps.

AI can act inside the workflow, so people, process, and technology have to support that action.

Stanford's 2026 AI Index reports that 88% of surveyed organizations used AI in 2025. It also summarizes measured productivity gains of 14% to 15% in customer support, 26% in software development, and 50% in marketing output across cited studies.

In the World Economic Forum's Future of Jobs Report 2025, 86% of surveyed employers expected AI and information-processing technologies to transform their business by 2030. Microsoft's 2025 Work Trend Index found that 82% of leaders expected to use digital labor within 12 to 18 months.

GRC teams still scale research, evidence collection, questionnaires, control mapping, and change monitoring through human coordination. AI adds capacity to that work.

PwC's 2026 Global AI Jobs Barometer, based on more than a billion job advertisements, associates the most AI-exposed companies with 40% higher productivity growth. It also reports faster headcount and wage growth among companies achieving the largest AI-related productivity gains.

Use that capacity to help experts cover more ground. An experienced reviewer should spend less time locating a policy, copying an obligation, formatting a response, or asking for status. Their time is better spent judging whether the evidence is sufficient, whether a risk is acceptable, and what the organization should do next.

AI should increase the amount of expert judgment an organization can apply while keeping decisions visible and accountable.

PPT+AI is Sorena's extension of People, Process, Technology. It separates AI from technology to make its operating role visible.

• People own the outcome. They set intent, contribute expertise, approve consequential outputs and changes, and remain accountable.
• Process governs the path. It defines triggers, required evidence, review gates, escalation, completion, and the measures used to judge the result.
• Technology holds the truth. It supplies permissioned data, source systems, integrations, identity, event history, and audit records.
• AI observes and moves the work. It retrieves, compares, maps, drafts, monitors, routes, measures, and recommends within the boundaries set by the other three.

Traditional systems record and route work. AI can also prepare the work, detect patterns across many cases, and propose an improvement. Its proposal does not authorize the change.

A human-led AI operating model changes where people spend their attention.

Microsoft describes emerging organizations as AI-operated but human-led. Employees direct specialized agents, review their work, and decide where automation belongs. In GRC, people should own applicability decisions, interpretations, risk acceptance, exceptions, and approvals.

They also remain accountable to customers, auditors, boards, and regulators. AI should bring them the relevant source material and complete the preparatory work before a decision reaches them.

A useful process specifies what starts the work, which sources AI may use, what the output must contain, who reviews it, what happens when evidence is missing, and how completion is recorded. It also defines the baseline, the success measures, and who may approve a process change.

BCG's 10-20-70 approach to AI transformation puts 70% of the effort into people and processes, 20% into technology and data, and 10% into algorithms. Organizations can create value before they have a perfect model. They need a workflow designed around what AI can already do well.

For GRC, assign each AI task to a named owner and a defined workflow. AI retrieves the source, prepares the work, flags uncertainty, routes the reviewer, records the decision, and preserves the evidence. When the same delay or correction keeps appearing, AI should open a review with the cases behind its recommendation.

Dependable AI needs governed context. The technology layer supplies it through a Single Source of Truth, current source material, identity, permissions, integrations, version history, event logs, and operational telemetry.

In an enterprise workflow, AI knows which material it may use. The reviewer can inspect the passage behind a claim. Event history shows the actual sequence, wait time, handoffs, rework, and exceptions. A later auditor can see what the system proposed, who approved it, and which source was current at the time.

The model can change. The governed context, measurement definitions, and accountability record should remain.

In the PPT+AI model, AI works inside defined boundaries.

For a compliance workflow, AI can read a new requirement, locate the relevant policy and control, compare the obligation with existing evidence, draft the response, identify a gap, propose the next action, route it to the owner, and assemble the review package. The reviewer receives prepared work instead of a blank page.

IBM reports that 78% of executives believe maximum value from agentic AI requires a new operating model. Give AI a defined job inside a governed process.

Execution produces data about how the operating model behaves. AI can examine that record and prepare a case for change across all four parts.

People: Find overloaded review queues, unclear ownership, repeated handoff failures, inconsistent interpretations, and correction patterns that point to a training or guidance gap. AI can recommend a clearer role, a job aid, or a different allocation of work. It should not make employment decisions or score people from opaque proxies.

Process: Reconstruct the path work actually took from event logs, compare it with the approved process, locate wait time and rework loops, group recurring exceptions, predict an SLA miss, and test whether a proposed routing or review rule would help. IBM describes how process mining uses timestamps and organizational data to expose bottlenecks and root causes, including discovery, conformance checking, and enhancement.

Technology: Detect stale or conflicting sources, broken integrations, permission failures, missing event data, configuration drift, duplicate records, rising latency or cost, and systems that no longer support the approved process. AI can identify the affected dependencies and prepare a remediation plan for the system owner.

Operating environment: Monitor authoritative regulatory publications, standards, threat information, vendor notices, customer commitments, incidents, and audit findings. AI can compare a change with policies, controls, contracts, evidence, and open work, then prepare the impact assessment and proposed updates.

Treat a pattern as evidence for review. Only authorized owners can change the organization.

Use AI to analyze the operating record without letting it approve its own changes.

1. Sense. Watch authoritative external sources and internal events for a new requirement, recurring delay, correction cluster, control failure, or change in demand.
2. Diagnose. Compare the intended process with actual cases. Separate a one-off exception from a repeated pattern, show the affected people, systems, controls, and customers, and state what the data cannot prove.
3. Recommend. Prepare the proposed process, policy, control, integration, staffing, or guidance change. Include supporting cases, expected effect, risk, confidence, dependencies, owner, and a rollback condition.
4. Decide. The accountable human reviews the evidence, resolves tradeoffs, and approves, rejects, or narrows the proposal.
5. Implement. AI can draft the updated procedure, control text, test cases, training note, work items, and monitoring rule. The approved change moves through normal change control.
6. Verify. Compare the new results with the baseline. Keep, adjust, or roll back the change, and preserve the decision and evidence.

A plausible recommendation can still be wrong. Process data can be incomplete, the measured pattern can have another cause, and an improvement for one metric can damage another.

NIST separates information-security measures into implementation, effectiveness and efficiency, and impact. That structure prevents a team from treating deployment as proof of value. The NIST AI RMF Measure playbook also calls for production monitoring, error and incident data, human feedback, overrides, drift checks, and documented performance changes.

Use a small set of measures tied to the purpose of one workflow:

Define the numerator, denominator, owner, source, review frequency, target, and risk limit for each metric. Compare with a baseline and segment results by workflow, risk class, business unit, model version, and degree of human review. Raw counts belong beside percentages when volume is small.

Keep the measures separate. One composite AI score hides the tradeoff between speed, quality, risk, and review effort. A 40% cycle-time reduction is useful only if material-error, rework, exception, and oversight measures remain within their approved limits.

Clear governance lets teams assign AI meaningful work. The NIST AI Risk Management Framework Core connects technical AI work to organizational policies, values, roles, and oversight. It calls for organizations to define responsibilities for human-AI configurations and document human-oversight processes. The GAO AI Accountability Framework organizes its practices around governance, data, performance, and monitoring.

Permissions control what AI can read. Workflow gates control what it can finalize. Evaluation shows where it performs well, monitoring catches drift and failure, and an accountable reviewer resolves consequential cases. Record overrides and appeals as operating data, but do not let the system treat every disagreement as proof that the human or the model was wrong.

AI may identify, draft, test, and recommend a change. Accountable people approve the decision, the risk, and the change to production.

Take a customer security questionnaire.

People: Legal, security, and compliance define the approved positions and assign the final reviewer.

Process: The workflow extracts each question, requires a source-backed answer, flags missing proof, and routes approval before anything is sent.

Technology: Policies, prior approved answers, controls, architecture records, evidence, and case events remain in permissioned systems connected to the workflow.

AI: Sorena Assessment reads the questionnaire, retrieves matching material, drafts answers, cites the evidence, identifies gaps, and sends the decisions to their owners.

After completion, AI can group material corrections, unanswered topics, evidence gaps, long waits, and repeated escalations. It may find that encryption answers are repeatedly corrected because the approved position is stale, or that most of the cycle time sits in one ownership queue. It prepares the cases, likely cause, proposed source or routing change, and expected measure. The policy owner or process owner decides whether to change it.

Track questionnaire cycle time, 90th-percentile queue age, first-pass acceptance, material corrections by reason, evidence freshness, reviewer minutes, and cost per approved response. AI takes on the searching, copying, formatting, chasing, and analysis. The team keeps the decisions.

Sorena brings the four parts into one governed workbench.

• Sorena SSOT gives the technology and AI layers permissioned, current context.
• Sorena Integrations connect the systems where organizational truth already lives.
• Sorena AI Assistant and Research Copilot retrieve, compare, explain, and cite.
• Assessment, Risk Management, Contract Ops, and Law Tracker put that intelligence into owned workflows.

The workbench should preserve the source, recommendation, reviewer action, exception, completion time, and outcome needed to examine the workflow later. Sorena keeps judgment with people, guardrails in the process, organizational truth in governed systems, and bounded execution with AI.

Skip the company-wide AI slogan. Choose one recurring workflow where experts lose time to retrieval, reconciliation, drafting, or follow-up.

Before adding AI, record a usable baseline: volume, median and 90th-percentile cycle time, wait time, first-pass acceptance, rework, evidence coverage, reviewer minutes, exceptions, and cost per approved outcome. Define the accountable person, the review path, the approved sources, the work AI may perform, and the conditions that force escalation.

Run a limited set of cases. Compare like with like, review a sample for material errors and missed issues, and inspect who gained or lost work. Keep the change only when it returns expert time or improves coverage without pushing quality, risk, or oversight outside the approved limit.

Then ask the system to watch the workflow for the next repeated delay, correction, gap, or external change and prepare the evidence for its owner.