AIGO — AI Governance Operating Framework

AI Control Assessment Template

Version: 0.1 Status: Draft Working Name: AIGO Full Name: AI Governance Operating Framework Document Identifier: AIGO-TPL-006 Document Type: AI Control Assessment Template Template Purpose: Controlled Assessment of AI Governance and Risk Controls

1. Template Purpose

This template provides the controlled structure for assessing the design, implementation, operation, effectiveness, evidence, and remediation of controls applicable to an AI system or AI governance process. The control assessment should establish traceability between:

AI system;
governance requirement;
risk;
control objective;
control;
control owner;
procedure;
control activity;
evidence;
design effectiveness;
implementation status;
operating effectiveness;
findings;
corrective action;
retesting;
residual risk;
assurance;
management decision.

A control assessment does not replace the organization’s approved AIGO AI Control Assessment Procedure.

2. Assessment Instructions

Complete all applicable sections. Where information is not available, record: Pending — [reason] Where a field does not apply, record: Not Applicable — [reason] Each material control should have a unique Control ID. Recommended identifiers include:

AI System ID;
Control Assessment ID;
Control ID;
Risk ID;
Procedure ID;
Evidence ID;
Finding ID;
Corrective Action ID;
Assurance ID;
Approval ID.

Control conclusions should be based on sufficient evidence and approved assessment criteria.

3. Assessment Record

3.1 Identification

AI System ID: Control Assessment ID: Assessment Version: Assessment Type:

Initial
Periodic
Triggered
Post-Incident
Post-Change
Reassessment
Pre-Approval
Post-Implementation

Assessment Status:

Draft
In Progress
Under Review
Approved
Approved with Conditions
Remediation Required
Closed

Assessment Owner: Lead Assessor: Control Owner: Reviewer: Approval Authority: Assessment Date: Effective Date: Next Review Date:

4. AI System Context

4.1 System Information

AI System Name: AI System Version: AI System Owner: Business Owner: Technical Owner: Current Lifecycle Stage: AIGO Classification:

4.2 Intended Purpose

Approved Intended Purpose:

4.3 Assessment Context

Context relevant to this control assessment:

5. Assessment Scope

5.1 Control Scope

Control / Control Family Being Assessed:

5.2 Lifecycle Scope

Select applicable stages:

Govern
Identify
Classify
Assess
Treat
Approve
Deploy
Operate
Monitor
Assure
Improve
Change
Continue
Retire

Applicable Lifecycle Stages:

5.3 Organizational Scope

Business Units / Functions Covered:

5.4 Geographic Scope

Jurisdictions / Locations Covered:

5.5 Exclusions

Excluded Controls / Activities: Exclusion Rationale:

6. Control Identification

6.1 Control Information

Control ID: Control Name: Control Family: Control Type:

Preventive
Detective
Corrective
Directive
Compensating
Other

Control Criticality:

Low
Medium
High
Critical

6.2 Control Objective

Control Objective:

6.3 Control Requirement

Requirement Addressed:

6.4 Control Description

Describe what the control requires or does:

6.5 Control Frequency

Control Frequency:

Continuous
Real-Time
Daily
Weekly
Monthly
Quarterly
Annual
Event-Driven
Other

Frequency Rationale:

7. Control Ownership

7.1 Control Owner

Control Owner: Role / Position: Accountability:

7.2 Control Performer

Control Performer(s):

7.3 Control Reviewer

Control Reviewer:

7.4 Control Approval Authority

Approval Authority:

7.5 Segregation of Duties

Segregation-of-Duties Requirements:

8. Risk Relationship

8.1 Risks Addressed

Risk ID	Risk	Risk Level	Control Relationship

8.2 Risk Treatment Relationship

How the control reduces or manages the identified risk:

8.3 Residual Risk Relationship

Expected contribution to residual-risk reduction:

9. Procedure Relationship

9.1 Applicable Procedure

Procedure Name: Procedure ID / Reference:

9.2 Control Activity

How the procedure operationalizes the control:

9.3 Control Execution

Describe how the control is performed:

9.4 Control Execution Evidence

Evidence generated by control execution:

10. Control Design Assessment

Control design assessment determines whether the control, if implemented and operated as specified, is capable of achieving its objective.

10.1 Design Criteria

Assess:

clear objective;
risk alignment;
defined ownership;
appropriate frequency;
appropriate authority;
appropriate coverage;
appropriate segregation;
defined exception handling;
defined escalation;
defined evidence.

10.2 Design Assessment

Design Rating:

Effective
Partially Effective
Ineffective
Not Assessed

Design Rationale:

10.3 Design Gaps

Identified Design Gaps:

11. Control Implementation Assessment

11.1 Implementation Status

Implementation Status:

Fully Implemented
Substantially Implemented
Partially Implemented
Not Implemented
Not Verified

11.2 Implementation Evidence

Implementation Evidence:

11.3 Implementation Gaps

Implementation Gaps:

12. Control Operating Effectiveness

12.1 Operating Assessment

Operating Effectiveness:

Effective
Partially Effective
Ineffective
Not Tested

12.2 Operating Period

Assessment Period:

12.3 Operating Evidence

Evidence of Actual Operation:

12.4 Operating Exceptions

Exceptions Identified:

12.5 Operating Rationale

Rationale:

13. Evidence Assessment

13.1 Evidence Requirements

The assessment should determine whether evidence demonstrates:

what was performed;
who performed it;
when it was performed;
what result was obtained;
whether exceptions occurred;
how exceptions were handled.

13.2 Evidence Quality

Evidence Quality:

Strong
Adequate
Moderate
Weak
Missing

Rationale:

13.3 Evidence Characteristics

Evidence Characteristic	Assessment	Rationale
Relevance
Completeness
Accuracy
Authenticity
Timeliness
Traceability
Integrity

14. Control Testing

14.1 Testing Method

Applicable methods may include:

inquiry;
observation;
inspection;
walkthrough;
reperformance;
technical testing;
sample testing;
data analysis;
automated testing;
independent validation.

Testing Methods Used:

14.2 Test Plan

Test Plan ID: Test Objective:

14.3 Test Procedures

Test Procedures:

14.4 Test Population

Population:

14.5 Sample

Sample Size: Sampling Method: Sampling Rationale:

15. Test Results

Test ID	Test Description	Expected Result	Actual Result	Pass / Fail	Evidence

15.1 Test Conclusion

Overall Test Conclusion:

16. Control Assessment Rating

16.1 Rating Scale

Rating	Definition
Effective	Control is appropriately designed, implemented, operating, and supported by sufficient evidence
Partially Effective	Control operates but has material limitations
Ineffective	Control does not adequately achieve its objective
Not Implemented	Control has not been implemented
Not Tested	Sufficient evidence is unavailable to determine effectiveness

16.2 Overall Control Rating

Overall Rating:

Effective
Partially Effective
Ineffective
Not Implemented
Not Tested

Overall Rationale:

17. Control Maturity

Where appropriate, assess control maturity.

Level	Description
1	Ad Hoc
2	Defined
3	Repeatable
4	Managed
5	Optimized

Control Maturity Level: Maturity Rationale:

18. Control Findings

18.1 Findings Register

Finding ID	Finding	Severity	Root Cause	Owner	Status

18.2 Finding Severity

Severity	Meaning
Critical	Immediate significant control failure
High	Material weakness requiring priority action
Medium	Significant weakness requiring remediation
Low	Limited weakness or improvement opportunity
Observation	Improvement opportunity without material deficiency

19. Individual Control Finding

19.1 Finding Identification

Finding ID: Control ID: Finding Title: Severity:

19.2 Criterion

Expected Requirement / Criterion:

19.3 Condition

Observed Condition:

19.4 Evidence

Supporting Evidence:

19.5 Cause

Root Cause / Contributing Cause:

19.6 Risk

Potential Risk / Impact:

19.7 Recommendation

Recommended Action:

20. Corrective Action

20.1 Corrective Action Record

Corrective Action ID: Finding ID: Action Owner: Priority: Target Date: Status:

20.2 Action

Corrective Action:

20.3 Root Cause Response

How the action addresses the root cause:

20.4 Required Evidence

Closure Evidence Required:

21. Corrective Action Tracking

Action ID	Finding	Owner	Priority	Due Date	Evidence	Status

22. Retesting and Effectiveness Verification

22.1 Retest Required

Retest Required:

22.2 Retest ID

Retest ID:

22.3 Retest Method

Retest Method:

22.4 Retest Result

Result:

Effective
Partially Effective
Ineffective
Not Complete

Result Rationale:

22.5 Corrective Action Effectiveness

Is the corrective action effective?

Yes
Partially
No
Not Yet Determined

Effectiveness Rationale:

23. Residual Risk

23.1 Risk Before Assessment

Risk Level Before Control Assessment:

23.2 Risk After Control Assessment

Residual Risk Level:

23.3 Control Contribution

How the control contributes to residual-risk reduction:

23.4 Risk Acceptance

Risk Acceptance Required: Risk Acceptance Record ID: Acceptance Authority:

24. Control Exceptions

24.1 Exception

Exception ID: Control Requirement: Reason for Exception: Risk: Compensating Controls: Requested Duration: Owner: Approval Authority:

24.2 Exception Monitoring

Monitoring Requirements: Review Date: Expiry Date:

25. Control Monitoring

25.1 Monitoring Requirements

Control Monitoring Method: Monitoring Frequency: Monitoring Owner:

25.2 Control Indicators

Indicator	Threshold	Frequency	Owner	Escalation	Evidence

25.3 Threshold Breach

Threshold Breach Process:

26. Control Change Assessment

26.1 Changes Affecting Control

Recent or Planned Changes:

26.2 Change Impact

Impact on Control Design / Operation:

26.3 Reassessment Requirement

Control Reassessment Required:

Yes
No
Pending

Rationale:

27. Lifecycle Assessment

Assess the control across relevant AIGO lifecycle stages.

Lifecycle Stage	Applicable	Control Status	Evidence	Assessment
Govern
Identify
Classify
Assess
Treat
Approve
Deploy
Operate
Monitor
Assure
Improve
Change
Continue
Retire

28. Control Dependencies

28.1 Upstream Dependencies

Controls / Processes Required Before This Control:

28.2 Downstream Dependencies

Controls / Processes Depending on This Control:

28.3 Shared Controls

Shared Controls / Common Services:

29. Control Evidence Profile

29.1 Evidence Repository

Evidence Repository: Evidence Owner:

29.2 Evidence Register

Evidence ID	Evidence Type	Description	Owner	Date	Location	Status

29.3 Evidence Gaps

Evidence Gaps:

30. Assurance Relationship

30.1 Assurance Requirements

Assurance Applicable: Assurance Frequency: Assurance Owner:

Assurance ID	Date	Scope	Result	Findings	Status

31. Incident Relationship

Incident ID	Date	Severity	Control Impact	Corrective Action	Status

31.2 Incident-Driven Reassessment

Did an incident trigger this assessment?

Incident Reference:

32. Change Relationship

Change ID	Date	Description	Control Impact	Approval	Status

32.2 Change-Driven Reassessment

Did a change trigger this control assessment?

Change Reference:

33. Control-to-Risk Traceability

Governance Requirement
       ↓
Risk
       ↓
Control Objective
       ↓
Control
       ↓
Procedure
       ↓
Control Activity
       ↓
Evidence
       ↓
Assessment
       ↓
Residual Risk

33.1 Traceability Matrix

Control ID	Risk ID	Procedure	Evidence ID	Assessment	Residual Risk

34. Control-to-Lifecycle Traceability

Control ID	Lifecycle Stage	Objective	Activity	Evidence	Status

35. Control-to-Evidence Traceability

Control ID	Evidence ID	Evidence Type	Owner	Date	Assessment Result

36. Management Review

36.1 Management Review Required

Required:

36.2 Review Reference

Review ID: Review Date:

36.3 Management Review Outcome

Outcome:

36.4 Management Actions

Actions:

37. Overall Assessment Conclusion

Overall Control Assessment Conclusion:

37.1 Key Strengths

37.2 Key Weaknesses

37.3 Key Findings

37.4 Residual Risk Position

Residual Risk Position:

37.5 Recommendation

Recommended Governance Decision:

38. Assessment Approval

38.1 Prepared By

Name: Role: Date:

38.2 Reviewed By

Name: Role: Date:

38.3 Approved By

Name: Role: Date:

38.4 Approval Decision

Decision:

Approved
Approved with Conditions
Remediation Required
Deferred
Rejected

Conditions:

39. Assessment Review Schedule

39.1 Periodic Review

Review Frequency: Next Review Date: Review Owner:

39.2 Triggered Reassessment

Reassessment should be considered following:

material incidents;
significant control failures;
material AI-system changes;
risk changes;
monitoring threshold breaches;
regulatory changes;
assurance findings;
changes in control ownership;
changes in operating environment.

Additional Triggers:

40. Assessment Change History

Version	Date	Change	Changed By	Reviewer	Approval
0.1		Initial control assessment

41. Assessment Traceability

The control assessment should maintain links to relevant AIGO records.

AIGO Record	Identifier
Governance Record
AI System Registration
AI System Profile
Classification Record
Risk Assessment
Procedure
Approval Record
Monitoring Record
Incident Records
Change Records
Assurance Records
Risk Acceptance Record
Improvement Records
Evidence Records

42. Control Assessment Completion Checklist

43. Template Usage Instructions

This template should be completed according to the organization’s approved AIGO AI Control Assessment Procedure. Control assessments should evaluate more than documentation existence. The assessor should determine whether the control is:

appropriately designed;
implemented;
operating;
supported by sufficient evidence;
effective in addressing the applicable risk or requirement.

A control should not be rated effective solely because a procedure or policy exists. Where deficiencies are identified, the assessment should establish:

finding;
root cause;
risk;
corrective action;
owner;
target date;
evidence;
retest;
effectiveness conclusion.

Control assessments should be repeated when material risks, systems, processes, controls, suppliers, regulations, or operating environments change.

44. Template Governance

44.1 Template Owner

Template Owner:

44.2 Template Review

Review Frequency: Next Review Date:

44.3 Template Change Control

Changes to this template should be managed through the applicable AIGO document and change-management process. Material changes should consider their effect on:

AI Control Assessment Procedure;
Governance Controls;
Risk Assessment;
AI System Profile;
AI System Registration;
Approval;
Monitoring;
Assurance;
Incident Management;
Change Management;
Risk Acceptance;
schemas;
mappings;
tools.

45. Document Control

Field	Value
Document	AIGO — AI Control Assessment Template
Version	0.1
Status	Draft
Document Identifier	`AIGO-TPL-006`
Document Type	AI Control Assessment Template
Template Owner
Approved By
Approval Date
Effective Date
Next Review Date

46. Template Status

Document: AIGO — AI Control Assessment Template Version: 0.1 Status: Draft Working Name: AIGO Full Name: AI Governance Operating Framework Document Identifier: AIGO-TPL-006 Document Type: AI Control Assessment Template This template provides the controlled structure for assessing AI governance and risk controls, including design, implementation, operation, evidence, effectiveness, findings, corrective action, retesting, residual risk, and assurance.

47. End of Template

AIGO — AI Control Assessment Template Document ID: AIGO-TPL-006 Version: 0.1 Status: Draft End of Template

​AIGO — AI Governance Operating Framework

​AI Control Assessment Template

​1. Template Purpose

​2. Assessment Instructions

​3. Assessment Record

​3.1 Identification

​4. AI System Context

​4.1 System Information

​4.2 Intended Purpose

​4.3 Assessment Context

​5. Assessment Scope

​5.1 Control Scope

​5.2 Lifecycle Scope

​5.3 Organizational Scope

​5.4 Geographic Scope

​5.5 Exclusions

​6. Control Identification

​6.1 Control Information

​6.2 Control Objective

​6.3 Control Requirement

​6.4 Control Description

​6.5 Control Frequency

​7. Control Ownership

​7.1 Control Owner

​7.2 Control Performer

​7.3 Control Reviewer

​7.4 Control Approval Authority

​7.5 Segregation of Duties

​8. Risk Relationship

​8.1 Risks Addressed

​8.2 Risk Treatment Relationship

​8.3 Residual Risk Relationship

​9. Procedure Relationship

​9.1 Applicable Procedure

​9.2 Control Activity

​9.3 Control Execution

​9.4 Control Execution Evidence

​10. Control Design Assessment

​10.1 Design Criteria

​10.2 Design Assessment

​10.3 Design Gaps

​11. Control Implementation Assessment

​11.1 Implementation Status

​11.2 Implementation Evidence

​11.3 Implementation Gaps

​12. Control Operating Effectiveness

​12.1 Operating Assessment

​12.2 Operating Period

​12.3 Operating Evidence

​12.4 Operating Exceptions

​12.5 Operating Rationale

​13. Evidence Assessment

​13.1 Evidence Requirements

​13.2 Evidence Quality

​13.3 Evidence Characteristics

​14. Control Testing

​14.1 Testing Method

​14.2 Test Plan

​14.3 Test Procedures

​14.4 Test Population

​14.5 Sample

​15. Test Results

​15.1 Test Conclusion

​16. Control Assessment Rating

​16.1 Rating Scale

​16.2 Overall Control Rating

​17. Control Maturity

​18. Control Findings

​18.1 Findings Register

​18.2 Finding Severity

​19. Individual Control Finding

​19.1 Finding Identification

​19.2 Criterion

​19.3 Condition

​19.4 Evidence

​19.5 Cause

​19.6 Risk

​19.7 Recommendation

​20. Corrective Action

​20.1 Corrective Action Record

AIGO — AI Governance Operating Framework

AI Control Assessment Template

1. Template Purpose

2. Assessment Instructions

3. Assessment Record

3.1 Identification

4. AI System Context

4.1 System Information

4.2 Intended Purpose

4.3 Assessment Context

5. Assessment Scope

5.1 Control Scope

5.2 Lifecycle Scope

5.3 Organizational Scope

5.4 Geographic Scope

5.5 Exclusions

6. Control Identification

6.1 Control Information

6.2 Control Objective

6.3 Control Requirement

6.4 Control Description

6.5 Control Frequency

7. Control Ownership

7.1 Control Owner

7.2 Control Performer

7.3 Control Reviewer

7.4 Control Approval Authority

7.5 Segregation of Duties

8. Risk Relationship

8.1 Risks Addressed

8.2 Risk Treatment Relationship

8.3 Residual Risk Relationship

9. Procedure Relationship

9.1 Applicable Procedure

9.2 Control Activity

9.3 Control Execution

9.4 Control Execution Evidence

10. Control Design Assessment

10.1 Design Criteria

10.2 Design Assessment

10.3 Design Gaps

11. Control Implementation Assessment

11.1 Implementation Status

11.2 Implementation Evidence

11.3 Implementation Gaps

12. Control Operating Effectiveness

12.1 Operating Assessment

12.2 Operating Period

12.3 Operating Evidence

12.4 Operating Exceptions

12.5 Operating Rationale

13. Evidence Assessment

13.1 Evidence Requirements

13.2 Evidence Quality

13.3 Evidence Characteristics

14. Control Testing

14.1 Testing Method

14.2 Test Plan

14.3 Test Procedures

14.4 Test Population

14.5 Sample

15. Test Results

15.1 Test Conclusion

16. Control Assessment Rating

16.1 Rating Scale

16.2 Overall Control Rating

17. Control Maturity

18. Control Findings

18.1 Findings Register

18.2 Finding Severity

19. Individual Control Finding

19.1 Finding Identification

19.2 Criterion

19.3 Condition

19.4 Evidence

19.5 Cause

19.6 Risk

19.7 Recommendation

20. Corrective Action

20.1 Corrective Action Record