AAIA lesson 2: AI governance programme

AI governance is the set of structures, roles, policies and decision rights that determine which AI systems an organisation builds or buys, who approves them, and who answers for what they do. For an auditor the question is concrete: is there a named owner, a defined approval path and a record that the path was followed? This lesson covers subtopic 1B, AI Governance and Program Management. Supporting tasks in the outline add three related questions: is ownership of AI-related risk, controls, procedures, decisions and standards defined, how does AI affect the workforce, and do awareness programmes match the organisation’s AI policies.

The parts of a programme

A programme that works has five visible parts.

• A charter or policy stating scope, principles and who has authority. It should say what counts as AI, because “AI” is often defined too narrowly to catch embedded vendor features.
• A governance body with a mandate to approve, condition or stop deployments. A committee that can only advise is a discussion forum.
• Defined roles. Typical ones are an executive sponsor, a business owner for each system, a model or product owner, a risk function, security and privacy specialists, and an independent review function.
• A lifecycle approval path proportionate to risk, with gates before build, before deployment and at periodic review.
• An inventory of every AI system, which is the foundation for everything else.

The programme should connect to existing governance (enterprise risk, information security, privacy, third-party management) rather than run beside it. Where it does run beside it, gaps open at the seams, usually in third-party AI and in embedded features.

Ownership is the audit centre

Weak programmes tend to have plenty of documents and unclear accountability. Useful distinctions:

A common finding is that accountability is assigned to a team or committee, not a person, or that the technical team has approved its own system. Both defeat the purpose: the person who benefits from deployment should not be the only one who can authorise it.

People: workforce and awareness

Governance also covers the people who use AI. Two checks follow from the outline.

• Awareness aligned with policy. Training and communications should teach what the AI policy actually says: what may not be pasted into public tools, which uses need approval, how to report a problem. The audit test is whether content matches the current policy, whether it reaches the right groups (builders, reviewers, ordinary users, executives) and whether completion and understanding are tracked.
• Workforce impact. Roles change when AI takes over tasks: some work disappears, some moves to checking AI output, some needs new skills. Governance should have assessed this, planned retraining and watched for side effects such as reviewers who lose the skill to challenge the system. Heavy reliance with no plan to keep human expertise is a risk in its own right.

Strategy alignment

Governance should tie each AI use to an organisational objective and to the organisation’s appetite for risk. The auditor looks for a stated reason for each system (the problem it addresses and the benefit expected), a view of whether the benefit justifies the risk, and a periodic check that the use still serves the strategy. AI adopted because it is available, with no owner of the expected benefit, is a governance weakness even when the technology works.

Worked example: a regional bank’s inventory

A bank of around 2,000 staff (a different organisation from the insurer of lesson 1) has a governance committee and a polished AI policy. The audit asks for the inventory and receives a list of 11 systems, all built by the data science team. Walking the business, the auditor finds four more: a customer-service chatbot supplied by a vendor, a résumé-screening feature switched on inside the HR platform, a spreadsheet tool using a generative assistant, and a marketing team using a public chatbot with customer text.

The findings fall out naturally. The inventory definition is too narrow, because it counts only internally built models. There is no discovery process, such as procurement checks or network and expense review. Because the HR feature supports employment decisions, it would normally attract the heaviest expectations, yet it never went through the approval path. The practitioner’s recommendation is therefore to broaden the definition, add risk classification per entry and tie procurement and software enablement to registration, rather than merely to add the four systems to the list.

To test completeness, an auditor does not take the inventory as the population. A reverse trace works better: start from procurement records, contracts, SaaS discovery output and interviews, and check each AI-capable item back to the inventory.

Easy to confuse

• Policy versus programme. A policy states intent. A programme includes the roles, gates and records that show it operating.
• Inventory versus register of approved systems. An inventory should include unapproved and shadow use; an approved list does not.
• Accountable versus responsible. The business owner is accountable for the outcome of an AI-supported decision even when a vendor or the data team performs the work.

How a practitioner applies it

Start with the artefacts: charter, committee terms of reference, approval records for a sample of systems, and the inventory. Then test operation: did the committee ever impose a condition, delay or reject a system? A body that has approved everything at first sight deserves questions. Finally, test linkage to the wider organisation. The AI governance topic page compares the main frameworks that governance programmes draw on.

Key points

• Governance means decision rights plus evidence that they are used.
• Accountability must rest with named individuals, and the approver must be independent of the builder.
• Governance bodies need authority to stop a deployment.
• The inventory must include vendor-supplied, embedded and unapproved AI.
• Test inventory completeness from outside the inventory, using procurement and discovery data.

Check yourself

This lesson covers subtopic 1B; the exam-focused summary is on the governance and risk recap.