Required sign-offs before approval

Many organizations put every AI initiative through a set of reviews before money is committed: privacy, security, legal, vendor risk, workforce impact. Roiva doesn't run those reviews. It records that each one happened, who signed it off, when, and against what evidence, and keeps that with the decision to approve the initiative.

None are required until an Owner or Admin adds one, so an account that doesn't use them sees nothing different.

Adding a required sign-off

Owners and Admins add them under Settings → Approvals, in Required sign-offs, and can make one stricter. Only an Owner (any of the account's Owners) can remove one, rename one, or move one from before review to before approval, since each loosens what an approval waits on: a renamed one is met by the sign-offs already given under its old name. The account's other Owners are notified of each. Choose one of the Suggested names (Workforce impact, Privacy review, Security review, Legal and IP review, Vendor risk review, Model risk review) or Add a sign-off with a name of your own. Each one is required either before an initiative is submitted for review or before it's approved. Either way, it must be signed off or waived before the initiative is approved, including one added while an initiative was already in review.

Every change is in the audit log with what it was before. Removing a requirement stops it from being required. Sign-offs already recorded against it stay, and decisions already made keep it in their record. The account's other Owners are told when one is removed, or moved from before review to before approval.

Signing one off

Each initiative's Overview shows its Required sign-offs, each with where it stands. A sign-off needs two things: a named person, and the review's record as evidence. The evidence can be a document already on the initiative or a link to the review in the tool that ran it. A document on its own doesn't count: uploading a privacy assessment changes nothing until a named person signs against it. An SOW or a contract can't be the evidence, since members can't see one.

• Sign off signs it in your own name. Any member can, except the initiative's owner. The owner can only where the account allows people to approve entries they prepared, or where nobody else could approve: no other Owner or Admin, and no named approver. A sign-off by someone who is made the initiative's owner afterwards no longer counts, and the Overview says so.
• Request sign-off asks another member to sign it off, optionally with the evidence attached. They're notified, and it's in their Inbox until they answer, as Requested on the Overview. They Sign off or Decline it with a reason, and whoever asked is told either way. A declined request leaves the sign-off needed again, and the Overview shows who declined and why. Whoever asked, or an Owner or Admin, can withdraw a request still waiting.
• Record for someone else is for a reviewer without a seat in Roiva, such as someone from the privacy or legal team. An Owner or Admin enters their name and email, attaches the evidence, and confirms that the evidence shows that person's sign-off. It reads "recorded by" wherever it shows. Someone who has a seat signs for themselves.
• Waive lets the initiative go ahead without the sign-off. Only an Owner can waive one, and has to say why. The reason shows on the initiative, in the approval's record and in the audit log. Waiving one that was requested of someone withdraws the request and tells them.

Whoever signed a sign-off, or an Owner or Admin, can withdraw it until the initiative is approved, and an Owner can withdraw a waiver. Removing the document a sign-off rests on withdraws the sign-off too. A sign-off whose evidence is gone, or that a malware scan flagged after it was signed, no longer counts: the Overview marks it, and it's withdrawn and signed again. Once the initiative is approved, the Overview shows the sign-offs as they stood at that moment, and the approval's record keeps them so. Moving the initiative back into review is a fresh submission: it waits on the sign-offs required before review, and opens them to change again for the next approval. Moving it back to Identified doesn't wait, so they can be recorded there.

Workforce impact

Workforce impact's sign-off starts from the business case. It shows the planned freed capacity a year, the hours a year that stands for at the initiative's loaded labor rate, and those hours as full-time equivalents, at 2,080 hours each (40 hours a week for 52 weeks). Whoever signs confirms or corrects the hours and the FTE, and the sign-off keeps what they signed. Where no labor rate is set, they enter the hours. Freed capacity is capacity, not cash: hours given back, priced at what they cost.

If the planned freed capacity changes after it's signed off, the sign-off stands, and the Overview says how the figure moved so the approver can see it.

Approving with requirements in place

Submit for Review and Approve wait until every sign-off they need is in, and say which are missing. An initiative's row in an approver's Inbox says how many of its sign-offs are in. An approval chain's earlier steps can be approved before then; the final step waits. The same holds however the initiative is approved: approving several together in the Inbox leaves an initiative still waiting on a sign-off in review and says so, the Assistant says what's missing and links to the initiative, and recording the date an initiative went live, which approves it, waits too.

An import can't approve an initiative past a required sign-off. Bringing initiatives in from a spreadsheet at a stage past Reviewing is refused while one is required: import them at Reviewing, or at Identified if a sign-off is required before review, and record the sign-offs on each. A tracker workbook that brings in initiatives approved outside Roiva, or in Reviewing while a sign-off is required before review, can be imported only by an Owner, and its approvals are recorded as made before the requirements applied.

The record

Every approval decision records where each required sign-off stood: signed off (by whom, against what), waived (by whom, and why), or made before the requirements applied. It's in the Approval Register under ROI → Reports and in the account export. The Board Brief, the Portfolio Snapshot and the Initiative Review name the sign-offs required when they were generated, and how much approved cash value comes from initiatives approved with one waived, or approved before a sign-off required now applied to them: approved before it was added, or brought in from a tracker workbook. Each month's value is read against the approval in force when that month began, so an initiative approved again with every sign-off still shows its earlier waiver on the months that approval covered. The amount is shown even when that cash nets to $0 or less. See Approving value and initiatives and Board Brief and reports.