title: “Control Assessment” description: “Assessing whether AIGO controls are implemented, effective, and supported by appropriate evidence.”
Control Assessment
Control assessment evaluates whether applicable governance controls have been implemented and whether they are operating as intended. It provides a structured mechanism for determining control status, identifying deficiencies, recording evidence, and supporting governance decisions.Purpose
Control assessment supports: * governance oversight * risk treatment verification * control effectiveness evaluation * evidence collection * approval decisions * assurance * remediation * continual improvementAssessment considerations
An assessment may consider: * control applicability * implementation status * design adequacy * operating effectiveness * supporting evidence * evidence quality * identified deficiencies * remediation actions * responsible owners * review status * assessment scope * assessment conclusions The appropriate assessment depth depends on the nature and significance of the control and the governance context in which it operates.Relationship to risk
Controls should be connected to the risks they are intended to address. This enables traceability from: risk → control → evidence → assessment → assurance Where governance rules are defined, control and assessment information may also participate in machine-readable evaluation: risk / requirement → control → evidence → rule → evaluation → findingAssessment outcomes
A control assessment may identify outcomes such as: * implemented * partially implemented * not implemented * effective * ineffective * not applicable * requires remediation * requires further evidence The specific outcome vocabulary should follow the applicable AIGO assessment and control definitions rather than being interpreted independently.Evidence
Assessment conclusions should be supported by appropriate evidence. Evidence can include documentation, records, test results, monitoring outputs, approvals, or other artifacts demonstrating implementation or operation. The relationship between evidence and assessment is important for both governance traceability and assurance.Evaluation
The AIGO evaluation layer can provide additional machine-readable checks relating to governance rules and conditions. Evaluation should complement, rather than automatically replace, human governance judgment where interpretation, context, or professional assessment is required.Source
The canonical procedure is maintained in:guidance/02-procedures/05-AIGO-AI-Control-Assessment-Procedure-v0.1.md
The machine-readable control structure is defined in:
schemas/03-control/03-AIGO-Control-Schema-v0.1.json
The corresponding assessment structure is defined in:
schemas/04-assessment/04-AIGO-Assessment-Schema-v0.1.json