Governance · 01 · AI governance and assurance
Independent assurance for systems that make or shape decisions.
Organizations are adopting AI systems faster than they are governing them. Customers, regulators and insurers have started to ask what controls exist. We establish the facts, strengthen the controls and produce the evidence.
What we review
Where AI is used, and how it is governed.
- Where AI is used, by whom, for what decisions, with what data
- Selection, procurement and vendor terms for AI systems and models
- Supervision: human review points, escalation, monitoring, logging
- Policy: acceptable use, data handling, disclosure to customers and staff
- Alignment to ISO/IEC 42001 and the NIST AI Risk Management Framework, and to sector rules
- Evidence quality for customers, auditors, insurers and regulators
Evidence you receive
Built to answer the questionnaire.
- AI use inventory with risk classification
- Gap assessment against the chosen framework with a ranked remediation plan
- Policy and supervision documentation ready for adoption
- An evidence pack built to answer customer and regulator questionnaires
Capabilities
What it covers.
AI use inventory and classification
An AI use inventory and classification establishes where AI systems are actually used across the organization, by whom, for what decisions, with what data, through which vendors, and how consequential each use is.
Learn more →02 / CapabilityISO/IEC 42001 readiness
ISO/IEC 42001 readiness prepares an organization for certification against the international standard for AI management systems: the scope and context, the AI policy and objectives, the risk and impact assessments, the controls in Annex A, the lifecycle processes and the records that show the system operates.
Learn more →03 / CapabilityNIST AI RMF alignment
NIST AI RMF alignment organizes an organization’s AI governance around the AI Risk Management Framework’s four functions, Govern, Map, Measure and Manage, so that AI risks are identified, measured and managed in a way that boards, customers and regulators recognize.
Learn more →04 / CapabilityAI vendor and model risk review
An AI vendor and model risk review assesses the third-party AI systems, models and AI-enabled services an organization relies on: what data they receive and retain, how they are trained and updated, what the provider commits to contractually, how outputs are controlled, and what happens when the provider changes or fails.
Learn more →05 / CapabilityAcceptable-use and supervision policy
An acceptable-use and supervision policy sets the rules for how staff and systems may use AI: which tools are approved, what data may and may not be entered, which uses require human review before action, how outputs are checked and attributed, what must be disclosed to customers and colleagues, and what is logged.
Learn more →06 / CapabilityImpact assessment for high-consequence uses
An impact assessment for high-consequence AI uses examines a specific AI system that makes or shapes decisions about people, safety, money or legal rights, and establishes what could go wrong, for whom, how likely it is, how it would be detected, and what controls reduce it to an acceptable level.
Learn more →07 / CapabilityAI evidence pack for customers and regulators
An AI evidence pack assembles the documentation customers, regulators, insurers and auditors now ask for about an organization’s use of AI: the inventory, the policy, the supervision arrangements, the vendor reviews, the impact assessments, the training records and the alignment to recognized frameworks, organized so a reviewer can find what they need without a meeting.
Learn more →Observe
Understand the environment, the risks, the obligations, and the operational constraints.Fortify
Strengthen practical safeguards without disrupting essential workflows.Verify
Test whether controls perform as intended.Evidence
Document the results clearly for leadership, auditors, clients, and partners.Sustain
Keep controls operating through reporting, review, remediation, and continuous improvement.