​

Assessment Schema

The AIGO Assessment Schema provides the machine-readable structure for recording governance assessments and their outcomes. An assessment represents a structured evaluation of a defined subject against defined criteria. The subject may be a risk, control, requirement, governance condition, lifecycle activity, or another governed object.

​

Purpose

The Assessment Schema provides a consistent structure for recording:

• what was assessed
• why it was assessed
• which criteria were applied
• who performed or owns the assessment
• what was found
• what conclusion was reached
• what evidence supports the conclusion
• what actions are required
• who is responsible for those actions
• what follow-up is required

This allows assessment results to become durable governance records rather than remaining only in documents, spreadsheets, or informal decisions.

​

Role in the AIGO architecture

Assessments form a connecting layer between governance requirements, governed objects, evidence, decisions, and assurance. A representative relationship is: governance requirement / risk / control → assessment → finding → action → evidence → assurance An assessment may therefore reference or relate to:

• AI systems
• risks
• controls
• governance requirements
• approvals
• evidence
• incidents
• changes
• monitoring activities
• assurance activities
• improvement activities

The exact relationships depend on the assessment context and the applicable AIGO schemas.

​

What an assessment represents

An assessment should identify a defined assessment subject and a defined assessment scope. For example, an organization may assess:

• whether a control has been implemented
• whether a risk has been adequately treated
• whether required evidence exists
• whether a governance condition has been satisfied
• whether a material change requires additional governance activity
• whether an approval condition remains satisfied
• whether a governance process is operating as intended

The assessment record should preserve enough information to understand what was evaluated and how the conclusion was reached.

​

Assessment criteria

An assessment should identify the criteria against which the subject was evaluated. Criteria may originate from:

• AIGO framework requirements
• AIGO controls
• organizational policies
• governance procedures
• risk-treatment requirements
• approval conditions
• contractual requirements
• applicable regulatory requirements
• defined governance rules

Where machine-readable evaluation is used, assessment criteria may also be represented through AIGO rules and evaluation specifications.

​

Assessment outcomes

Assessment records may capture outcomes such as:

• passed
• failed
• partially satisfied
• not satisfied
• not applicable
• requires remediation
• requires further evidence
• requires management decision
• inconclusive

The actual permitted values should always follow the canonical Assessment Schema and the applicable AIGO definitions. An assessment outcome should not be interpreted independently from its scope, criteria, findings, evidence, and context.

​

Findings and actions

An assessment may identify one or more findings. A finding can identify:

• the observed condition
• the expected condition
• the identified gap
• the significance of the finding
• related risks
• affected controls
• required actions
• responsible owners
• target dates
• supporting evidence

Where remediation is required, the assessment should preserve traceability from the finding to the resulting action and subsequent verification. A practical relationship is: assessment → finding → remediation action → verification → evidence

​

Evidence

Assessment conclusions should be supported by appropriate evidence where evidence is required by the assessment scope or applicable governance criteria. Evidence may include:

• policies
• procedures
• system records
• configuration records
• test results
• monitoring outputs
• approval records
• incident records
• change records
• audit or assurance results
• other documented governance artifacts

The assessment should maintain a relationship to the relevant evidence rather than merely stating that evidence exists. This allows an organization to reconstruct the basis for the assessment conclusion.

​

Assessment ownership

Assessment records should identify appropriate responsibility for:

• assessment execution
• assessment review
• finding ownership
• remediation
• approval where required
• follow-up verification

The required level of independence should depend on the significance and purpose of the assessment. For higher-risk or assurance-related assessments, the organization may require additional review or independent assessment.

​

Relationship to risk

Risk assessments and other governance assessments can use the Assessment Schema to preserve structured assessment results. A typical risk relationship is: AI system → risk → assessment → treatment → control → evidence Assessment results may therefore influence:

• risk treatment
• residual-risk determination
• risk acceptance
• control requirements
• approval decisions
• monitoring requirements
• assurance activities

​

Relationship to controls

Control assessments are a major use of the Assessment Schema. A control assessment can determine whether a control is:

• applicable
• implemented
• adequately designed
• operating effectively
• supported by sufficient evidence
• requiring remediation

This creates the traceability chain: control → assessment → evidence → finding → remediation → assurance The Control Schema represents the control itself, while the Assessment Schema represents the assessment performed against the control. This separation allows the same control definition to be assessed repeatedly over its lifecycle.

​

Relationship to approval

Assessment results can provide information required for governance approval. For example: AI system → classification → risk assessment → control assessment → evidence → approval An approval decision should not be treated as a substitute for the underlying assessments. Instead, the approval record can reference the relevant assessment results and evidence that supported the decision.

​

Relationship to monitoring and assurance

Monitoring can identify conditions that require a new assessment or reassessment. Similarly, assurance activities may review existing assessments to determine whether:

• the assessment scope was appropriate
• the criteria were correctly applied
• conclusions were adequately supported
• findings were addressed
• evidence was sufficient
• follow-up occurred as required

This creates a relationship between operational monitoring, governance assessment, and independent or management assurance.

​

Relationship to machine-readable evaluation

AIGO separates governance records from evaluation rules. The assessment record represents what was assessed and the resulting governance conclusion. The evaluation layer defines machine-readable conditions that can be applied to governed records. The conceptual architecture is: governance records → rules → evaluation → findings An assessment may therefore provide input to machine-readable evaluation without becoming the evaluation rule itself. The repository currently includes validation for:

• rule definitions
• evaluation fixtures
• evaluation semantics
• evaluation validation
• orchestration configuration
• orchestration validation

These capabilities support more systematic evaluation of defined governance conditions. Automated evaluation should not be interpreted as automatically replacing human governance judgment where context, interpretation, professional expertise, or decision authority is required.

​

Reassessment

Assessments should be revisited when the underlying conditions materially change. Potential reassessment triggers include:

• changes to the AI system
• changes to intended use
• changes to classification
• changes to risk
• changes to controls
• significant incidents
• material changes
• changes to applicable requirements
• new evidence
• expired assessment validity periods
• assurance findings
• monitoring results
• governance evaluation findings

Reassessment should preserve the relationship between the previous assessment, the trigger for reassessment, and the resulting new assessment.

​

Machine-readable implementation

The Assessment Schema can be used as the structural contract for governance systems that store or exchange assessment records. An implementation may use the schema to:

1. create an assessment record
2. identify the assessment subject
3. define the assessment scope and criteria
4. record findings and conclusions
5. associate supporting evidence
6. create remediation or follow-up actions
7. link the assessment to related governance records
8. submit the record for review or approval
9. use the record as an input to evaluation or assurance
10. preserve the completed assessment as lifecycle evidence

Organizations may implement these capabilities through databases, governance platforms, APIs, workflow systems, or other technology. The AIGO schema defines the structured representation; it does not prescribe a particular software architecture.

​

Validation

Assessment artifacts participate in the broader AIGO validation model. Repository validation can check relevant:

• schema integrity
• references
• traceability
• control relationships
• evidence relationships
• framework consistency
• document integrity
• repository health
• rule definitions
• evaluation fixtures
• evaluation orchestration

A passing validation result provides evidence that the tested repository artifacts satisfy the implemented validation checks within the applicable scope. It does not establish legal compliance, certification, accreditation, or regulatory conformity.

​

Canonical source

Machine-readable schema: schemas/04-assessment/04-AIGO-Assessment-Schema-v0.1.json Schema documentation: schemas/04-assessment/04-AIGO-Assessment-Schema-Documentation-v0.1.md Operational procedure: guidance/02-procedures/05-AIGO-AI-Control-Assessment-Procedure-v0.1.md Implementation template: guidance/03-templates/06-AIGO-AI-Control-Assessment-Template-v0.1.md