Controls
Use the Controls workspace to record and manage governance controls associated with an AI system. Controls can address identified risks, governance requirements, and defined governance objectives.When to use it
Use this workspace when you need to:- define a governance control;
- link a control to identified risks;
- assign control responsibilities;
- record implementation status;
- define how and when the control is executed;
- establish monitoring and review requirements;
- update or retire an existing control.
What to enter
Control definition
Record:- Control Name — a concise name for the control.
- Control Objective — what the control is intended to achieve.
- Control Owner — the responsible governance role.
- Status — the current lifecycle state of the control.
- Control Family — the applicable control grouping.
- Control Type — for example preventive, detective, corrective, directive, compensating, or other.
- Control Description — additional information describing the control.
Scope and risk relationship
Record:- Lifecycle Stages — stages of the AI system lifecycle where the control applies.
- Risk IDs — identifiers of risks addressed by the control.
Control responsibility
Record:- Control Performers — roles responsible for performing the control.
- Control Reviewer — role responsible for reviewing control performance.
- Approval Authority — role with applicable approval authority.
Implementation and execution
Record:- Criticality — the importance or criticality assigned to the control.
- Frequency — how frequently the control operates.
- Implementation Status — the current implementation state.
- Execution Method — how the control is performed.
- Execution Trigger — the event or condition that causes execution.
Monitoring and review
Use Monitoring required when ongoing monitoring of the control is required. Where applicable, record:- Review Frequency.
- Next Review Date.
What the result means
A saved control becomes a governance record associated with the AI system. The record provides traceability between: control → objective → risks → responsibilities → implementation → monitoring → review A control record does not by itself establish legal compliance, certification, accreditation, or conformity assessment. Control effectiveness or implementation should be assessed through the organization’s applicable evaluation, evidence, review, monitoring, and assurance activities.Reviewing existing controls
The Control History section lists previously recorded controls. For each control you can:- View Details to inspect the governance record;
- Edit Details to update the control;
- Delete the control when appropriate under the organization’s record-management rules.
What comes next
Controls can be connected to:- identified risks and risk treatment;
- governance requirements and objectives;
- evidence;
- reviews and approvals;
- monitoring activities;
- reassessment and assurance activities.