AI Business Case Verification Checklist

Freeze the review packet

Assign the case a version and review date. Preserve the decision request, executive summary, option descriptions, source register, calculations, assumptions, risk register, delivery plan, approval route, and any AI-assisted working files that support material claims. Record file hashes or stable identifiers where practical so the reviewer can tell whether the approved object later changed.

The current 2026 UK Green Book explains appraisal as the comparison of options against business as usual, with objectives, costs, benefits, risks, uncertainty, and evaluation considered together. The companion HM Treasury business-case guidance describes the Five Case Model. These are UK public-sector sources; organizations should tailor them rather than claim that using the checklist makes a private proposal compliant with them.

Before review, answer yes or no and link the evidence:

If the packet changes during review, issue a new version and rerun affected checks.

• Is the requested decision, accountable decision-maker, deadline, scope, and spending or risk boundary explicit?
• Is the baseline dated, reproducible, and separated from forecasts?
• Does the packet distinguish observed facts, external evidence, estimates, assumptions, and generated text?
• Are source dates, owners, extraction methods, and limitations recorded?
• Can a reviewer reproduce every number used in the executive summary?
• Are unresolved contradictions and missing evidence visible rather than silently reconciled?

Sources: [1] [2]

Trace claims and recalculate the model

Create a review table with one row for every material benefit, cost, risk, dependency, delivery, and outcome claim. Include claim ID, wording, claim type, source, source date, calculation, assumption, owner, verification result, exception, and disposition. Sampled review is unsuitable for the claims that determine the preferred option; test all of them.

Recalculate totals from the underlying records rather than checking only spreadsheet formulas. Confirm units, period, population, inflation or discount basis where relevant, internal labor, implementation effort, continuing review cost, supplier charges, contingency, and exit cost. Look for double-counted time, benefits without a realization route, and costs assigned to different populations or periods. Mark time savings as capacity until an accountable plan explains how that capacity becomes a cash, service, quality, or resilience outcome.

HM Treasury publishes an official business-case reviewer checklist. It is a useful primary reference for review questions, but its government context and publication date must remain visible. This page turns that review idea into an AI-specific evidence test; it does not replace organizational finance, procurement, legal, privacy, or security review.

Sources: [3]

Challenge the option comparison

Confirm that business as usual, a credible non-AI improvement, the proposed AI intervention, and “defer and collect evidence” were considered where they could change the decision. Each option should use the same objective, time horizon, affected population, cost categories, benefit definitions, risk treatment, and evidence threshold. Return the case if the preferred option receives optimistic assumptions that are not applied to alternatives.

Run at least four adverse cases: lower benefit, higher human-review cost, delayed integration, and early supplier exit. Add scenario-specific tests for data access, model error, workforce impact, accessibility, operational capacity, and incident response. Record the switching point at which the recommendation changes. The NIST AI RMF Core supports documenting context, roles, impacts, measurements, monitoring, and risk treatment; it is voluntary and does not approve a business case.

Verify these release conditions:

• Each option has a named owner and implementable operating model.
• Important dependencies have evidence, an owner, a due date, and a fallback.
• Human oversight has capacity, authority, instructions, and an escalation route.
• The proposal defines representative testing, stop conditions, monitoring, and rollback.
• Commercial terms, data rights, intellectual-property assumptions, switching limits, and exit arrangements are reviewed by qualified owners.
• The approver can authorize the exact stage, spend, data use, operating change, and residual risk—or the packet names separate authorities.

Sources: [4]

Worked checklist on a weak case

A synthetic service team proposes an AI assistant for 10,000 monthly requests. The draft says the assistant will “save 40 percent of handling time” and recommends annual licensing. The frozen packet contains a two-week vendor demonstration, a spreadsheet, and a security questionnaire.

Claim tracing shows that the 40 percent figure came from 80 selected requests with complete inputs; 34 percent of normal requests have missing attachments. Recalculation finds that the model excluded reviewer time, integration support, and the license minimum. The non-AI intake-form option was dismissed without cost or performance evidence. A sensitivity test shows that the AI option loses its cost advantage when review exceeds 2.7 minutes per request.

The checklist disposition is repair, not reject or approve. The team must build a representative historical test set, measure attachment exceptions, cost human review, compare the intake-form change on the same horizon, add a limited-pilot exit clause, and route data-use and spending decisions to their actual authorities. A revised case may recommend a bounded pilot, but the original annual-license decision is unsupported.

The evidence artifact retained with the review contains the frozen-file manifest, claim trace, recalculation workbook, option-comparability table, sensitivity results, exception log, disposition, owner, due date, and retest result. This makes the review reproducible instead of turning “check complete” into an unexamined assertion.

Issue the disposition and preserve residual uncertainty

Use four dispositions. Pass means the stated decision is supported within recorded limits. Conditional pass means named conditions can be enforced before action. Repair means evidence or analysis is incomplete but remediable. Not assessable means the source population, model, or authority route is too incomplete to support a conclusion. Record who decided the disposition, what version was reviewed, exceptions, expiry, and the next evidence gate.

Fail the release check when a headline claim cannot be traced, the baseline or calculation cannot be reproduced, credible alternatives are absent, material contradictions are hidden, the preferred option depends on an unowned assumption, or the approval route cannot authorize the proposal. After any material change, retest the affected claims and confirm that downstream documents use the reviewed version.

Two Prune can place a participant in a realistic review simulation and observe how they trace sources, reproduce calculations, challenge options, use AI support, and communicate residual uncertainty. That is assessment evidence about observed work in the simulation. It is not investment advice, financial assurance, procurement approval, legal or regulatory compliance, proof of business impact, or an automated employment decision.