Every firm has policies for document retention, review and client release. On a busy Thursday in a lodgement month, a policy stored in a manual still depends on someone remembering it at the right moment.
Automation makes it possible to place some of those rules in the execution path. The workflow can refuse to start without a completed readiness check, hold a material output for a named approver or block an outbound action without the required authority. Any evaluation, including one of our platform, should identify which controls are enforced in this way and which still depend on human practice.
Four controls, one recurring quarter
Take a BAS-shaped process, because it carries four controls that repeatedly matter and every accounting reader knows its rhythm.
The readiness control. BAS work is fit to start once the reconciliation is done and the period’s data is settled. A readiness control tests those conditions before the workflow begins. If they fail, the work does not start and the missing item is visible before review turns it into rework.
The exception control. Somewhere in the run, something won’t match — a transaction that resists its coding, a figure outside the expected range. The control question is precise: what stops, who receives it, and what context travels with it? An exception that halts everything is a bottleneck; one that disappears into a shared inbox is a risk. The binding version routes the exception to a named person with what they need to judge it, while the rest of the work proceeds.
The approval control. Some outputs are material, including a statement that will be lodged or a summary a client will act on. The control identifies those outputs and records whose sign-off they require, in order. Routine steps continue while the material points hold for the named approvers.
The action authority. The client-facing or regulator-facing action remains with the person who holds the professional obligation. In the BAS example, the system prepares the lodgement and the accountant performs it.
Where the controls come from
These controls are captured with the people who run the work before the workflow is built.
In practice, that means walking each shortlisted workflow decision by decision and writing down, for every point where a call gets made: what the decision is, what information it needs, whether a rule already governs it, what a wrong call costs, and who it escalates to when it can’t be settled. Where that knowledge lives only in the heads of the people doing the work, handing the process to software before capturing it creates the risk. The decisions with rules and low consequence become the automated path. The decisions with judgement or real consequence become the exception routes, the approval points and the retained actions — the four controls above, derived from the firm’s own answers rather than a vendor’s defaults.
That capture is part of the roadmap work. By the time anything runs, the firm has recorded where the gates sit and who holds them.
What “binding” means mechanically
The enforcement mechanics determine whether a control can survive pressure or a later configuration change.
On VonBolt Workforce, when a workflow reaches a point that requires approval, the platform creates a hold. That hold pins the exact version of the governing policy it was created under, and writes the ordered approver requirements — who must approve, in what sequence — as a frozen record at that moment. The work waits. Approving it later against different rules, or a conveniently edited policy, isn’t a temptation anyone has to resist: the pinned version and the frozen requirements are what the decision is evaluated against, and the decision itself is recorded with them.
Outbound communication runs through the same discipline. Before the platform emails anything, the message must pass a proving path: the redaction check recorded, the sending authority resolved and matched to the current workflow, and an intent-to-send and delivery record tied to that same message — each step refusing to proceed without the one before it. Nothing goes out without its record.
These mechanisms place the control in the execution path. The workflow cannot use a changed approval rule for an existing hold or send a message without completing the required proving steps.
Why this is the adoption question, not a footnote
The profession’s own hesitations point here. Thomson Reuters’ 2026 research on tax firms found inaccurate responses were cited by 76.4% of respondents, privacy and confidentiality by 70.5%, and data security by 70.1%. In a separate 2025 survey of 2,275 professionals across legal, risk, compliance, tax, accounting, audit and trade, 50% named demonstrable accuracy as a barrier to AI investment. Those concerns are related, but not interchangeable. Accuracy is tested through source checks, exception handling and approval; privacy and security require their own access, redaction and egress controls.
APES 110 is not an AI standard and should not be dressed up as one. It is the profession’s ethics code. Its principles of objectivity and professional competence and due care, together with its emphasis on professional judgement, are obligations a firm must retain while routine work runs. Binding controls and recorded decisions provide one practical way to make that retention visible, rather than merely assert it in a policy document.
The question to carry into any evaluation
Every process does not need every control. Too many approval points can recreate the bottleneck the workflow was meant to remove. The design work is to identify where readiness matters, which exceptions require judgement, which outputs are consequential enough to hold and which actions must remain in professional hands.
The useful evaluation is therefore specific. Test whether the workflow starts when readiness has failed. Try to pass an output without the named approval. Change a policy after a hold is created and confirm the original requirements still govern it. Attempt an outbound message without the recorded redaction and sending authority. The failed attempts provide evidence about the controls under the conditions tested.
That is the standard we build to and the standard customers should apply to us. If you want to test a real process against it, get in touch.
Damien Zeller is the Principal of VonBolt Technology Group.
