AAIR lesson 2: AI governance structures
An AI system’s risk is owned by a named person in the business, the use-case owner, while the board sets direction, a committee reviews the significant cases, the risk function challenges and assurance checks independently. Governance structures turn “someone should look after this” into assigned accountability with the authority to act, and two ISACA headings cover it: organisational processes and alignment (1B) and ownership, oversight and accountability (1C).
Alignment: build on what exists
Alignment (1B) means AI risk uses the organisation’s existing processes instead of inventing new ones. An organisation already has a way to approve projects, handle change, register risks, onboard suppliers and report to leadership. AI risk is added into those paths with extra questions, for example “does this change introduce a model?” in change management or “does this supplier embed AI?” in procurement.
A separate AI process is easy to bypass and cannot compare AI risk with other enterprise risks. Alignment also means interpreting existing appetite statements for AI, for instance whether automated decisions affecting customers are within appetite at all.
Who does what
Titles vary by organisation, so reason from the responsibility rather than the label.
| Role | Responsibility |
|---|---|
| Board | Sets direction and appetite, receives reporting, asks for assurance |
| Senior management or AI committee | Approves higher-risk use cases, resolves conflicts, resources the programme |
| Use-case owner | Accountable for the business outcome and its risk; accepts residual risk |
| Model owner | Responsible for the model’s performance, documentation and changes |
| Risk function (second line) | Sets method, challenges assessments, aggregates and reports |
| Assurance (internal audit, third line) | Independently tests whether governance and controls work |
The three lines model is the backbone. The first line (business and technology teams) owns and manages risk. The second line (risk and compliance) advises, sets standards and monitors. The third line (internal audit) gives independent assurance. Two common failures: the risk function ends up owning the risk, or nobody does because “the AI team” is not a person.
Human oversight at critical decision points
Oversight means a human who can understand, question and override the system at a point where the outcome matters. One of the “Other Skills Tested” in the outline is to assess human oversight controls at critical decision points, so a risk professional asks whether it really works:
- Does the reviewer have the information and time to disagree, or do they approve hundreds of cases an hour?
- Does the reviewer have authority to override and to stop the system?
- Are overrides recorded, and does anyone analyse them?
If reviewers approve nearly everything, oversight may be nominal. Records of reviews and overrides are the evidence that the control operates. A policy that demands oversight shows intent only.
Worked example: a 200-person lender
A 200-person consumer lender adopts a vendor model that recommends whether to approve small loans. At first the project sits with the IT team, and when asked who is accountable, the answer is “the AI team”. A risk professional proposes the following.
- The head of lending becomes the use-case owner and signs the residual risk acceptance, since the business bears the outcome.
- A data science lead becomes the model owner, responsible for validation records and change notes.
- The loan model is classed as higher risk because it affects access to credit, so it goes to the management AI committee, which includes risk, legal and compliance.
- The risk function checks the assessment and records the risk in the existing enterprise register under the same rating scale.
- A credit officer reviews every decline recommended by the model, can overturn it, and the overrides are logged and reported monthly.
- Internal audit adds the model to its plan to test the review.
Easy to confuse
- Accountable versus responsible. The owner is accountable for the outcome and may delegate tasks, but not accountability.
- Second line versus third line. The risk function is part of management; internal audit is independent of it.
- Oversight in a policy versus oversight in operation. Only operation is evidence.
Key points
- AI risk is owned by a named business role, not by a team name or by the risk function.
- Alignment builds AI questions into existing approval, change, procurement and risk processes.
- The board sets direction and appetite, committees review higher-risk cases, and internal audit gives independent assurance.
- Effective human oversight needs information, time, authority to override and recorded evidence.
Check yourself
Question 1. A company's AI chatbot causes complaints. When asked who is accountable for its risk, managers answer 'the AI team shares it'. What should the risk professional recommend FIRST?
- A. Enlarge the AI team so it has more capacity
- B. Assign a named use-case owner in the business with authority over the risk
- C. Run awareness training for all managers
- D. Add a monthly complaints report for the board
Show answer
Answer: B
Accountability needs a named individual with authority, usually the business owner of the use case. A larger team, more training or more reporting do not fix the missing owner, so they cannot be the first step.
Want more questions like this? Full AAIR practice tests →
Question 2. In the three lines model, which activity belongs to the third line?
- A. Operating the model day to day and managing its risks
- B. Defining the enterprise risk assessment method
- C. Challenging the business’s risk ratings for AI use cases
- D. Independently testing whether AI controls operate as designed
Show answer
Answer: D
The third line, internal audit, independently tests whether governance and controls operate. Owning risk is the first line, and both setting the risk method and challenging assessments sit with the second line.
Want more questions like this? Full AAIR practice tests →
Question 3. A reviewer approves 99.9% of AI loan recommendations, spends about ten seconds on each, and no overrides are recorded. What is the BEST conclusion?
- A. Oversight may be nominal and should be tested for real challenge
- B. The model is accurate, so the control is effective
- C. The control is effective because a reviewer exists
- D. The control is effective because the policy requires oversight
Show answer
Answer: A
Rapid approval with no recorded overrides suggests the oversight may be nominal, so the control needs testing for reviewer information, time and authority. A high approval rate alone does not prove the model is accurate, and existence of a policy or reviewer shows design, not operation.
Want more questions like this? Full AAIR practice tests →
This lesson continues Domain 1, AI Risk Governance and Framework Integration (37% of the exam), and covers subtopics 1B and 1C. The recap in AAIR governance and frameworks condenses the same ground, and the cheat sheet lists the key terms.