Assurance
AI governance controls
A Control is a practical recurring measure that meets an obligation or reduces risk.
Control example
Requirement: human oversight is required. Control: high-impact AI recommendations must receive human review before final action.
Control lifecycle
- 1Select or create the control and link applicable requirements.
- 2Assign an owner and record implementation status.
- 3Attach or request supporting evidence.
- 4Test whether the control operates as intended.
- 5Create Findings and remediation when it does not.
Avoid concept overlap
- A Control is not the authoritative Requirement.
- A Control is not the one-time Task used to implement it.
- A Control is not the Assessment or Test used to verify it.