AIGO — AI Governance Operating Framework

AI Assurance Template

Version: 0.1 Status: Draft Working Name: AIGO Full Name: AI Governance Operating Framework Document Identifier: AIGO-TPL-012 Document Type: AI Assurance Template Template Purpose: Controlled Planning, Performance, Reporting, Follow-Up, and Closure of AI Assurance Activities

1. Template Purpose

This template provides the controlled structure for planning, performing, documenting, reporting, following up, and closing an AI assurance activity under the AIGO AI Governance Operating Framework. AI assurance provides objective or appropriately independent evaluation of whether AI governance arrangements, risks, controls, processes, evidence, and operating practices are functioning as intended. An assurance activity may examine:

AI governance;
organizational accountability;
AI system registration;
classification;
risk management;
controls;
control effectiveness;
evidence;
human oversight;
monitoring;
incidents;
change management;
approvals;
supplier governance;
regulatory requirements;
continual improvement.

This template does not replace the organization’s approved AIGO AI Assurance Procedure.

2. Assurance Instructions

Complete all applicable sections. Where information is unavailable, record: Pending — [reason] Where a field does not apply, record: Not Applicable — [reason] Use controlled identifiers wherever possible. Recommended identifiers include:

AI System ID;
Assurance ID;
Finding ID;
Risk ID;
Control ID;
Evidence ID;
Corrective Action ID;
Verification ID;
Change ID;
Incident ID;
Approval ID;
Improvement ID.

Assurance conclusions should be based on defined criteria and sufficient appropriate evidence.

3. Assurance Record

3.1 Identification

AI System ID: Assurance ID: Assurance Version: Assurance Title: Assurance Type:

Initial
Periodic
Triggered
Post-Incident
Post-Change
Control Assurance
Governance Assurance
Compliance Assessment
Technical Assurance
Independent Review
Other

Assurance Status:

Draft
Planned
In Progress
Fieldwork Complete
Reporting
Awaiting Management Response
Closed
Follow-Up
Reopened

Assurance Owner: Assurance Lead: Review Team: Engagement Sponsor: Date Initiated: Fieldwork Start Date: Fieldwork End Date: Report Date: Next Follow-Up Date:

4. Assurance Independence and Objectivity

4.1 Independence Requirement

Required Level of Independence:

Internal Management Review
Second-Line Review
Independent Assurance
Third-Line Assurance
External Assurance
Other

4.2 Independence Assessment

Is the assurance team sufficiently independent from the activities being reviewed?

Yes
No
Partially
Not Applicable

Rationale:

4.3 Conflicts of Interest

Potential Conflicts of Interest: Mitigating Actions:

4.4 Objectivity Requirements

Objectivity Requirements:

5. Assurance Objective

5.1 Primary Objective

Assurance Objective:

5.2 Assurance Questions

The assurance activity should establish whether:

governance requirements are implemented;
responsibilities are assigned;
risks are appropriately managed;
controls are designed appropriately;
controls operate effectively;
evidence is sufficient;
monitoring is functioning;
incidents are managed;
changes are governed;
approvals are appropriate;
identified deficiencies are addressed.

Applicable Assurance Questions:

6. Assurance Scope

6.1 AI System Scope

AI System(s) Covered:

6.2 Organizational Scope

Business Units / Functions Covered:

6.3 Geographic Scope

Jurisdictions / Locations Covered:

6.4 Lifecycle Scope

Select applicable stages:

Govern
Identify
Classify
Assess
Treat
Approve
Deploy
Operate
Monitor
Assure
Improve
Change
Continue
Retire

Applicable Lifecycle Stages:

6.5 Review Period

Period Under Review:

6.6 Exclusions

Excluded Activities / Systems: Exclusion Rationale:

7. Assurance Criteria

7.1 Criteria Sources

Applicable criteria may include:

AIGO Framework Charter;
AIGO Principles;
AIGO Governance Domains;
AIGO Governance Roles;
AIGO AI Governance Lifecycle;
AIGO AI Risk Management;
AIGO Governance Controls;
AIGO maturity requirements;
AIGO implementation guidance;
AIGO procedures;
approved organizational policies;
contractual requirements;
laws;
regulations;
applicable standards;
applicable external frameworks.

Applicable Criteria Sources:

7.2 Criteria Register

Criterion ID	Requirement / Criterion	Source	Applicable Area	Evidence

7.3 Criteria Interpretation

Interpretive Guidance / Assessment Basis:

8. AI System Context

8.1 System Information

System Name: System Version: System Owner: Business Owner: Technical Owner: Current Lifecycle Stage: AIGO Classification:

8.2 Intended Purpose

Approved Intended Purpose:

8.3 Operating Context

Operating Context:

8.4 Business Criticality

Business Criticality:

Low
Medium
High
Critical

Rationale:

9. Risk-Based Assurance Planning

9.1 Key Risks

Risk ID	Risk	Level	Assurance Relevance	Owner

9.2 Assurance Prioritization

Priority Areas:

9.3 Risk Factors

Consider:

potential harm;
affected persons;
decision significance;
automation;
risk level;
control criticality;
incidents;
monitoring findings;
recent changes;
regulatory significance;
supplier dependency.

Risk Factors:

10. Assurance Work Program

10.1 Planned Activities

Applicable activities may include:

document review;
interviews;
observation;
walkthrough;
control testing;
evidence inspection;
technical testing;
data analysis;
sampling;
reperformance;
independent validation;
management review.

Planned Activities:

10.2 Work Program

Work Program ID	Area	Objective	Method	Owner	Status

11. Evidence Plan

11.1 Evidence Requirements

Required Evidence:

11.2 Evidence Sources

Potential sources include:

policies;
procedures;
AI system records;
risk assessments;
control assessments;
approvals;
monitoring records;
incidents;
changes;
assurance records;
system logs;
test results;
training records;
supplier records.

Applicable Sources:

11.3 Evidence Repository

Evidence Repository: Evidence Owner:

12. Evidence Quality Assessment

Evidence should be assessed for:

relevance;
completeness;
authenticity;
accuracy;
timeliness;
integrity;
traceability.

12.1 Evidence Quality Rating

Overall Evidence Quality:

Strong
Adequate
Moderate
Weak
Insufficient

Rationale:

12.2 Evidence Limitations

Known Evidence Limitations:

13. Sampling

13.1 Population

Population Under Review:

13.2 Sample Size

Sample Size:

13.3 Sampling Method

Method:

Judgmental
Random
Risk-Based
Stratified
Systematic
Other

Methodology:

13.4 Sampling Rationale

Rationale:

13.5 Sampling Limitations

Limitations:

14. Interviews and Inquiry

14.1 Interview Plan

Interview ID	Role / Function	Objective	Date	Interviewer	Evidence

14.2 Interview Results

Key Findings:

14.3 Management Representations

Relevant Management Representations: Management representations should not be treated as the sole basis for an assurance conclusion where stronger evidence is reasonably available.

15. Governance Assurance

15.1 Governance Areas Reviewed

Assess:

governance authority;
accountability;
roles;
decision rights;
escalation;
management review;
governance reporting.

Applicable Areas:

15.2 Governance Result

Result:

Effective
Generally Effective
Partially Effective
Ineffective
Unable to Conclude

Rationale:

15.3 Governance Findings

Findings:

16. AI System Registration Assurance

16.1 Registration Criteria

Criteria:

16.2 Registration Testing

Testing Performed:

16.3 Result

Result:

Effective
Generally Effective
Partially Effective
Ineffective
Unable to Conclude

Rationale:

17. Classification Assurance

17.1 Classification Review

Classification Record ID: Current Classification:

17.2 Classification Testing

Testing:

17.3 Result

Result:

Appropriate
Requires Reassessment
Inadequate
Unable to Conclude

Rationale:

18. Risk Management Assurance

18.1 Risk Criteria

Criteria:

18.2 Risk Testing

Assess:

risk identification;
analysis;
evaluation;
treatment;
residual risk;
acceptance;
monitoring;
reassessment.

Testing Results:

18.3 Result

Result:

Effective
Generally Effective
Partially Effective
Ineffective
Unable to Conclude

Rationale:

19. Control Assurance

19.1 Controls Reviewed

Control ID	Control	Criticality	Design Result	Operating Result	Evidence

19.2 Control Testing

Testing Method:

19.3 Control Effectiveness Result

Overall Control Result:

Effective
Generally Effective
Partially Effective
Ineffective
Unable to Conclude

Rationale:

20. Human Oversight Assurance

20.1 Oversight Requirements

Human Oversight Requirement:

20.2 Oversight Testing

Assess:

review capability;
challenge capability;
override capability;
human authority;
competence;
traceability.

Testing Results:

20.3 Result

Result:

Effective
Generally Effective
Partially Effective
Ineffective
Unable to Conclude

Rationale:

21. Monitoring Assurance

21.1 Monitoring Criteria

Criteria:

21.2 Monitoring Testing

Assess:

indicators;
thresholds;
data collection;
alerts;
escalation;
reviews;
evidence.

Testing Results:

21.3 Result

Result:

Effective
Generally Effective
Partially Effective
Ineffective
Unable to Conclude

Rationale:

22. Incident Management Assurance

22.1 Incident Criteria

Criteria:

22.2 Incident Testing

Assess:

detection;
registration;
severity;
containment;
investigation;
corrective action;
recovery;
closure;
lessons learned.

Testing Results:

22.3 Result

Result:

Effective
Generally Effective
Partially Effective
Ineffective
Unable to Conclude

Rationale:

23. Change Management Assurance

23.1 Change Criteria

Criteria:

23.2 Change Testing

Assess:

change classification;
impact assessment;
risk assessment;
control assessment;
testing;
approval;
deployment;
monitoring;
rollback;
closure.

Testing Results:

23.3 Result

Result:

Effective
Generally Effective
Partially Effective
Ineffective
Unable to Conclude

Rationale:

24. Approval Assurance

24.1 Approval Criteria

Criteria:

24.2 Approval Testing

Assess:

authority;
evidence;
risk;
controls;
conditions;
decision;
deployment authorization.

Testing Results:

24.3 Result

Result:

Effective
Generally Effective
Partially Effective
Ineffective
Unable to Conclude

Rationale:

25. Third-Party Governance Assurance

25.1 Third-Party Scope

Suppliers / Providers Reviewed:

25.2 Assurance Areas

Assess:

supplier due diligence;
contractual requirements;
risk;
security;
privacy;
assurance;
incident notification;
change notification;
evidence.

Testing Results:

25.3 Result

Result:

Effective
Generally Effective
Partially Effective
Ineffective
Unable to Conclude
Not Applicable

Rationale:

26. Regulatory and External Requirement Assurance

26.1 Requirements Reviewed

Requirement	Source	Applicability	Testing Result	Evidence

26.2 Result

Result:

Effective
Generally Effective
Partially Effective
Ineffective
Unable to Conclude

Rationale:

27. Testing Results

27.1 Test Register

Test ID	Area	Test Procedure	Expected Result	Actual Result	Result	Evidence

27.2 Exceptions

Testing Exceptions:

27.3 Testing Conclusion

Conclusion:

28. Findings

28.1 Findings Register

Finding ID	Area	Finding	Severity	Risk	Owner	Status

28.2 Finding Severity

Severity	Meaning
Critical	Immediate significant governance weakness or unacceptable exposure
High	Material weakness requiring priority action
Medium	Significant weakness requiring remediation
Low	Limited weakness or improvement opportunity
Observation	Improvement opportunity without material deficiency

29. Individual Assurance Finding

29.1 Finding Identification

Finding ID: Area: Severity: Risk Level:

29.2 Criterion

Expected Requirement / Criterion:

29.3 Condition

Observed Condition:

29.4 Evidence

Supporting Evidence:

29.5 Cause

Root Cause / Contributing Cause:

29.6 Risk / Impact

Potential Risk / Impact:

29.7 Recommendation

Recommendation:

30. Management Response

30.1 Management Response

Response:

30.2 Agreed Action

Agreed Corrective Action:

30.3 Action Owner

Owner:

30.4 Target Date

Target Date:

30.5 Management Acceptance

Management Acceptance Status:

Accepted
Partially Accepted
Rejected
Pending

31. Corrective Action

31.1 Corrective Action Record

Corrective Action ID: Finding ID: Owner: Priority: Due Date: Status:

31.2 Corrective Action

Action:

31.3 Root Cause Response

How the action addresses root cause:

31.4 Closure Evidence

Required Closure Evidence:

32. Corrective Action Follow-Up

32.1 Follow-Up Status

Status:

Not Started
In Progress
Complete
Overdue
Verified
Closed

32.2 Follow-Up Evidence

Evidence:

32.3 Effectiveness Verification

Verification Required: Verification Result:

Effective
Partially Effective
Ineffective
Not Yet Determined

Verification Rationale:

33. Assurance Conclusion

33.1 Conclusion Categories

Possible overall conclusions include:

Effective
Generally Effective
Partially Effective
Ineffective
Unable to Conclude

33.2 Overall Conclusion

Conclusion:

33.3 Conclusion Rationale

Rationale:

33.4 Key Strengths

33.5 Key Weaknesses

33.6 Key Risks

34. Assurance Limitations

34.1 Limitations

Potential limitations include:

sampling;
incomplete evidence;
unavailable records;
restricted system access;
time limitations;
technical limitations;
reliance on representations;
scope restrictions.

Applicable Limitations:

34.2 Effect on Conclusion

Impact of Limitations:

35. Management Summary

35.1 Executive Summary

Summary of Assurance Result:

35.2 Key Decisions Required

Management / Governance Decisions Required:

35.3 Priority Actions

Priority Actions:

36. Assurance Report

36.1 Report Information

Report ID: Report Date: Report Owner: Distribution:

36.2 Report Sections

The assurance report should include, as applicable:

executive summary;
scope;
objective;
criteria;
methodology;
limitations;
testing;
findings;
management responses;
corrective actions;
overall conclusion.

Additional Report Requirements:

37. Assurance Escalation

37.1 Escalation Triggers

Escalation may be required when:

critical findings are identified;
high-severity findings remain unresolved;
material risk exceeds tolerance;
mandatory controls fail;
unauthorized AI operation is identified;
material legal or regulatory concern exists;
evidence is insufficient to support continued operation.

Applicable Triggers:

37.2 Escalation Authority

Escalation Authority:

37.3 Escalation Decision

Decision:

Continue
Correct
Restrict
Suspend
Escalate Further
Retire
Other

Rationale:

38. Assurance and Risk Relationship

Risk ID	Risk	Assurance Finding	Residual Risk	Action

38.2 Risk Reassessment

Risk Reassessment Required: Risk Assessment ID:

39. Assurance and Control Relationship

Control ID	Control	Assessment Result	Finding	Residual Risk	Action

39.2 Control Reassessment

Control Reassessment Required: Assessment ID:

40. Assurance and Incident Relationship

Incident ID	Date	Severity	Assurance Relevance	Result

40.2 Incident Follow-Up

Additional Incident Review Required:

41. Assurance and Change Relationship

Change ID	Date	Description	Assurance Relevance	Result

41.2 Change Follow-Up

Additional Change Review Required:

42. Assurance Evidence

42.1 Evidence Repository

Assurance Evidence Repository: Evidence Owner:

42.2 Evidence Register

Evidence ID	Evidence Type	Description	Owner	Date	Location	Status

42.3 Evidence Completeness

Evidence Status:

Complete
Substantially Complete
Partially Complete
Incomplete

Evidence Gaps:

43. Assurance Traceability

The assurance record should maintain links to relevant AIGO records.

AIGO Record	Identifier
Governance Record
AI System Registration
AI System Profile
Classification Record
Risk Assessment
Control Assessment
Approval Record
Monitoring Records
Incident Records
Change Records
Risk Acceptance Records
Corrective Action Records
Improvement Records
Evidence Records

44. Assurance Traceability Model

Governance Requirement
       ↓
Assurance Criterion
       ↓
Evidence
       ↓
Test
       ↓
Observation
       ↓
Finding
       ↓
Risk
       ↓
Corrective Action
       ↓
Verification
       ↓
Conclusion
       ↓
Continual Improvement

45. Follow-Up and Closure

45.1 Engagement Closure

The assurance engagement may be closed when:

planned testing is complete;
evidence is sufficient;
findings are validated;
management responses are recorded;
conclusion is issued;
report is approved;
follow-up responsibilities are assigned.

Engagement Closure Status:

Open
Closed
Closed with Follow-Up

45.2 Follow-Up Requirements

Follow-Up Required: Follow-Up Owner: Follow-Up Date:

45.3 Final Closure

Closure Authority: Closure Date: Closure Record ID:

46. Continual Improvement

46.1 Improvement Sources

Improvement opportunities may originate from:

assurance findings;
recurring deficiencies;
control weaknesses;
evidence gaps;
incidents;
monitoring;
changes;
management review;
stakeholder feedback.

Improvement Opportunities:

46.2 Improvement Actions

Improvement ID	Source	Description	Owner	Priority	Target Date	Status

47. Assurance Review and Approval

47.1 Prepared By

Name: Role: Date:

47.2 Reviewed By

Name: Role: Date:

47.3 Approved By

Name: Role: Date:

47.4 Assurance Decision

Decision:

Approved
Approved with Follow-Up
Returned for Revision
Deferred
Rejected

Conditions:

48. Assurance Review Schedule

48.1 Periodic Assurance

Review Frequency: Next Review Date: Assurance Owner:

48.2 Triggered Assurance

Additional assurance may be initiated after:

significant incidents;
material changes;
major risk changes;
significant control failures;
repeated findings;
regulatory developments;
material monitoring deviations.

Additional Triggers:

49. Assurance Change History

Version	Date	Change	Changed By	Reviewer	Approval
0.1		Initial assurance record

50. Assurance Completion Checklist

51. Template Usage Instructions

This template should be completed according to the organization’s approved AIGO AI Assurance Procedure. Assurance should be:

risk-based;
evidence-based;
objective;
appropriately independent;
traceable;
documented;
proportionate to the AI system and assurance objective.

An assurance conclusion should not be based solely on management statements where appropriate evidence can reasonably be obtained. Sampling limitations should be explicitly documented. A finding should identify, where applicable:

criterion;
condition;
evidence;
cause;
risk;
severity;
recommendation;
management response;
corrective action;
verification.

Corrective actions should be followed up until effectiveness has been appropriately demonstrated or the authorized governance body has formally accepted the remaining risk.

52. Template Governance

52.1 Template Owner

Template Owner:

52.2 Template Review

Review Frequency: Next Review Date:

52.3 Template Change Control

Changes to this template should be managed through the applicable AIGO document and change-management process. Material changes should consider their effect on:

AI Assurance Procedure;
Governance Controls;
Risk Assessment;
Control Assessment;
Monitoring;
Incident Management;
Change Management;
Approval;
Risk Acceptance;
Management Review;
Continuous Improvement;
schemas;
mappings;
tools.

53. Document Control

Field	Value
Document	AIGO — AI Assurance Template
Version	0.1
Status	Draft
Document Identifier	`AIGO-TPL-012`
Document Type	AI Assurance Template
Template Owner
Approved By
Approval Date
Effective Date
Next Review Date

54. Template Status

Document: AIGO — AI Assurance Template Version: 0.1 Status: Draft Working Name: AIGO Full Name: AI Governance Operating Framework Document Identifier: AIGO-TPL-012 Document Type: AI Assurance Template This template provides the controlled structure for planning, performing, evidencing, evaluating, reporting, escalating, following up, and closing AI assurance activities throughout the AIGO AI Governance Operating Framework.

55. End of Template

AIGO — AI Assurance Template Document ID: AIGO-TPL-012 Version: 0.1 Status: Draft End of Template

​AIGO — AI Governance Operating Framework

​AI Assurance Template

​1. Template Purpose

​2. Assurance Instructions

​3. Assurance Record

​3.1 Identification

​4. Assurance Independence and Objectivity

​4.1 Independence Requirement

​4.2 Independence Assessment

​4.3 Conflicts of Interest

​4.4 Objectivity Requirements

​5. Assurance Objective

​5.1 Primary Objective

​5.2 Assurance Questions

​6. Assurance Scope

​6.1 AI System Scope

​6.2 Organizational Scope

​6.3 Geographic Scope

​6.4 Lifecycle Scope

​6.5 Review Period

​6.6 Exclusions

​7. Assurance Criteria

​7.1 Criteria Sources

​7.2 Criteria Register

​7.3 Criteria Interpretation

​8. AI System Context

​8.1 System Information

​8.2 Intended Purpose

​8.3 Operating Context

​8.4 Business Criticality

​9. Risk-Based Assurance Planning

​9.1 Key Risks

​9.2 Assurance Prioritization

​9.3 Risk Factors

​10. Assurance Work Program

​10.1 Planned Activities

​10.2 Work Program

​11. Evidence Plan

​11.1 Evidence Requirements

​11.2 Evidence Sources

​11.3 Evidence Repository

​12. Evidence Quality Assessment

​12.1 Evidence Quality Rating

​12.2 Evidence Limitations

​13. Sampling

​13.1 Population

​13.2 Sample Size

​13.3 Sampling Method

​13.4 Sampling Rationale

​13.5 Sampling Limitations

​14. Interviews and Inquiry

​14.1 Interview Plan

​14.2 Interview Results

​14.3 Management Representations

​15. Governance Assurance

​15.1 Governance Areas Reviewed

​15.2 Governance Result

​15.3 Governance Findings

​16. AI System Registration Assurance

​16.1 Registration Criteria

​16.2 Registration Testing

​16.3 Result

​17. Classification Assurance

​17.1 Classification Review

​17.2 Classification Testing

​17.3 Result

​18. Risk Management Assurance

​18.1 Risk Criteria

​18.2 Risk Testing

​18.3 Result

​19. Control Assurance

​19.1 Controls Reviewed

​19.2 Control Testing

​19.3 Control Effectiveness Result

​20. Human Oversight Assurance

​20.1 Oversight Requirements

​20.2 Oversight Testing

​20.3 Result

​21. Monitoring Assurance

​21.1 Monitoring Criteria

AIGO — AI Governance Operating Framework

AI Assurance Template

1. Template Purpose

2. Assurance Instructions

3. Assurance Record

3.1 Identification

4. Assurance Independence and Objectivity

4.1 Independence Requirement

4.2 Independence Assessment

4.3 Conflicts of Interest

4.4 Objectivity Requirements

5. Assurance Objective

5.1 Primary Objective

5.2 Assurance Questions

6. Assurance Scope

6.1 AI System Scope

6.2 Organizational Scope

6.3 Geographic Scope

6.4 Lifecycle Scope

6.5 Review Period

6.6 Exclusions

7. Assurance Criteria

7.1 Criteria Sources

7.2 Criteria Register

7.3 Criteria Interpretation

8. AI System Context

8.1 System Information

8.2 Intended Purpose

8.3 Operating Context

8.4 Business Criticality

9. Risk-Based Assurance Planning

9.1 Key Risks

9.2 Assurance Prioritization

9.3 Risk Factors

10. Assurance Work Program

10.1 Planned Activities

10.2 Work Program

11. Evidence Plan

11.1 Evidence Requirements

11.2 Evidence Sources

11.3 Evidence Repository

12. Evidence Quality Assessment

12.1 Evidence Quality Rating

12.2 Evidence Limitations

13. Sampling

13.1 Population

13.2 Sample Size

13.3 Sampling Method

13.4 Sampling Rationale

13.5 Sampling Limitations

14. Interviews and Inquiry

14.1 Interview Plan

14.2 Interview Results

14.3 Management Representations

15. Governance Assurance

15.1 Governance Areas Reviewed

15.2 Governance Result

15.3 Governance Findings

16. AI System Registration Assurance

16.1 Registration Criteria

16.2 Registration Testing

16.3 Result

17. Classification Assurance

17.1 Classification Review

17.2 Classification Testing

17.3 Result

18. Risk Management Assurance

18.1 Risk Criteria

18.2 Risk Testing

18.3 Result

19. Control Assurance

19.1 Controls Reviewed

19.2 Control Testing

19.3 Control Effectiveness Result

20. Human Oversight Assurance

20.1 Oversight Requirements

20.2 Oversight Testing

20.3 Result

21. Monitoring Assurance

21.1 Monitoring Criteria