> ## Documentation Index
> Fetch the complete documentation index at: https://docs.aigoframework.com/llms.txt
> Use this file to discover all available pages before exploring further.

# 12 AIGO AI Assurance Template v0.1

# AIGO — AI Governance Operating Framework

## AI Assurance Template

**Version:** 0.1
**Status:** Draft
**Working Name:** AIGO
**Full Name:** AI Governance Operating Framework
**Document Identifier:** `AIGO-TPL-012`
**Document Type:** AI Assurance Template
**Template Purpose:** Controlled Planning, Performance, Reporting, Follow-Up, and Closure of AI Assurance Activities

***

# 1. Template Purpose

This template provides the controlled structure for planning, performing, documenting, reporting, following up, and closing an AI assurance activity under the AIGO AI Governance Operating Framework.

AI assurance provides objective or appropriately independent evaluation of whether AI governance arrangements, risks, controls, processes, evidence, and operating practices are functioning as intended.

An assurance activity may examine:

* AI governance;
* organizational accountability;
* AI system registration;
* classification;
* risk management;
* controls;
* control effectiveness;
* evidence;
* human oversight;
* monitoring;
* incidents;
* change management;
* approvals;
* supplier governance;
* regulatory requirements;
* continual improvement.

This template does not replace the organization's approved AIGO AI Assurance Procedure.

***

# 2. Assurance Instructions

Complete all applicable sections.

Where information is unavailable, record:

**Pending — \[reason]**

Where a field does not apply, record:

**Not Applicable — \[reason]**

Use controlled identifiers wherever possible.

Recommended identifiers include:

* AI System ID;
* Assurance ID;
* Finding ID;
* Risk ID;
* Control ID;
* Evidence ID;
* Corrective Action ID;
* Verification ID;
* Change ID;
* Incident ID;
* Approval ID;
* Improvement ID.

Assurance conclusions should be based on defined criteria and sufficient appropriate evidence.

***

# 3. Assurance Record

## 3.1 Identification

**AI System ID:**

**Assurance ID:**

**Assurance Version:**

**Assurance Title:**

**Assurance Type:**

* Initial
* Periodic
* Triggered
* Post-Incident
* Post-Change
* Control Assurance
* Governance Assurance
* Compliance Assessment
* Technical Assurance
* Independent Review
* Other

**Assurance Status:**

* Draft
* Planned
* In Progress
* Fieldwork Complete
* Reporting
* Awaiting Management Response
* Closed
* Follow-Up
* Reopened

**Assurance Owner:**

**Assurance Lead:**

**Review Team:**

**Engagement Sponsor:**

**Date Initiated:**

**Fieldwork Start Date:**

**Fieldwork End Date:**

**Report Date:**

**Next Follow-Up Date:**

***

# 4. Assurance Independence and Objectivity

## 4.1 Independence Requirement

**Required Level of Independence:**

* Internal Management Review
* Second-Line Review
* Independent Assurance
* Third-Line Assurance
* External Assurance
* Other

## 4.2 Independence Assessment

**Is the assurance team sufficiently independent from the activities being reviewed?**

* Yes
* No
* Partially
* Not Applicable

**Rationale:**

## 4.3 Conflicts of Interest

**Potential Conflicts of Interest:**

**Mitigating Actions:**

## 4.4 Objectivity Requirements

**Objectivity Requirements:**

***

# 5. Assurance Objective

## 5.1 Primary Objective

**Assurance Objective:**

## 5.2 Assurance Questions

The assurance activity should establish whether:

* governance requirements are implemented;
* responsibilities are assigned;
* risks are appropriately managed;
* controls are designed appropriately;
* controls operate effectively;
* evidence is sufficient;
* monitoring is functioning;
* incidents are managed;
* changes are governed;
* approvals are appropriate;
* identified deficiencies are addressed.

**Applicable Assurance Questions:**

***

# 6. Assurance Scope

## 6.1 AI System Scope

**AI System(s) Covered:**

## 6.2 Organizational Scope

**Business Units / Functions Covered:**

## 6.3 Geographic Scope

**Jurisdictions / Locations Covered:**

## 6.4 Lifecycle Scope

Select applicable stages:

* Govern
* Identify
* Classify
* Assess
* Treat
* Approve
* Deploy
* Operate
* Monitor
* Assure
* Improve
* Change
* Continue
* Retire

**Applicable Lifecycle Stages:**

## 6.5 Review Period

**Period Under Review:**

## 6.6 Exclusions

**Excluded Activities / Systems:**

**Exclusion Rationale:**

***

# 7. Assurance Criteria

## 7.1 Criteria Sources

Applicable criteria may include:

* AIGO Framework Charter;
* AIGO Principles;
* AIGO Governance Domains;
* AIGO Governance Roles;
* AIGO AI Governance Lifecycle;
* AIGO AI Risk Management;
* AIGO Governance Controls;
* AIGO maturity requirements;
* AIGO implementation guidance;
* AIGO procedures;
* approved organizational policies;
* contractual requirements;
* laws;
* regulations;
* applicable standards;
* applicable external frameworks.

**Applicable Criteria Sources:**

## 7.2 Criteria Register

| Criterion ID | Requirement / Criterion | Source | Applicable Area | Evidence |
| ------------ | ----------------------- | ------ | --------------- | -------- |
|              |                         |        |                 |          |
|              |                         |        |                 |          |
|              |                         |        |                 |          |

## 7.3 Criteria Interpretation

**Interpretive Guidance / Assessment Basis:**

***

# 8. AI System Context

## 8.1 System Information

**System Name:**

**System Version:**

**System Owner:**

**Business Owner:**

**Technical Owner:**

**Current Lifecycle Stage:**

**AIGO Classification:**

## 8.2 Intended Purpose

**Approved Intended Purpose:**

## 8.3 Operating Context

**Operating Context:**

## 8.4 Business Criticality

**Business Criticality:**

* Low
* Medium
* High
* Critical

**Rationale:**

***

# 9. Risk-Based Assurance Planning

## 9.1 Key Risks

| Risk ID | Risk | Level | Assurance Relevance | Owner |
| ------- | ---- | ----- | ------------------- | ----- |
|         |      |       |                     |       |
|         |      |       |                     |       |
|         |      |       |                     |       |

## 9.2 Assurance Prioritization

**Priority Areas:**

## 9.3 Risk Factors

Consider:

* potential harm;
* affected persons;
* decision significance;
* automation;
* risk level;
* control criticality;
* incidents;
* monitoring findings;
* recent changes;
* regulatory significance;
* supplier dependency.

**Risk Factors:**

***

# 10. Assurance Work Program

## 10.1 Planned Activities

Applicable activities may include:

* document review;
* interviews;
* observation;
* walkthrough;
* control testing;
* evidence inspection;
* technical testing;
* data analysis;
* sampling;
* reperformance;
* independent validation;
* management review.

**Planned Activities:**

## 10.2 Work Program

| Work Program ID | Area | Objective | Method | Owner | Status |
| --------------- | ---- | --------- | ------ | ----- | ------ |
|                 |      |           |        |       |        |
|                 |      |           |        |       |        |
|                 |      |           |        |       |        |

***

# 11. Evidence Plan

## 11.1 Evidence Requirements

**Required Evidence:**

## 11.2 Evidence Sources

Potential sources include:

* policies;
* procedures;
* AI system records;
* risk assessments;
* control assessments;
* approvals;
* monitoring records;
* incidents;
* changes;
* assurance records;
* system logs;
* test results;
* training records;
* supplier records.

**Applicable Sources:**

## 11.3 Evidence Repository

**Evidence Repository:**

**Evidence Owner:**

***

# 12. Evidence Quality Assessment

Evidence should be assessed for:

* relevance;
* completeness;
* authenticity;
* accuracy;
* timeliness;
* integrity;
* traceability.

## 12.1 Evidence Quality Rating

**Overall Evidence Quality:**

* Strong
* Adequate
* Moderate
* Weak
* Insufficient

**Rationale:**

## 12.2 Evidence Limitations

**Known Evidence Limitations:**

***

# 13. Sampling

## 13.1 Population

**Population Under Review:**

## 13.2 Sample Size

**Sample Size:**

## 13.3 Sampling Method

**Method:**

* Judgmental
* Random
* Risk-Based
* Stratified
* Systematic
* Other

**Methodology:**

## 13.4 Sampling Rationale

**Rationale:**

## 13.5 Sampling Limitations

**Limitations:**

***

# 14. Interviews and Inquiry

## 14.1 Interview Plan

| Interview ID | Role / Function | Objective | Date | Interviewer | Evidence |
| ------------ | --------------- | --------- | ---- | ----------- | -------- |
|              |                 |           |      |             |          |
|              |                 |           |      |             |          |

## 14.2 Interview Results

**Key Findings:**

## 14.3 Management Representations

**Relevant Management Representations:**

Management representations should not be treated as the sole basis for an assurance conclusion where stronger evidence is reasonably available.

***

# 15. Governance Assurance

## 15.1 Governance Areas Reviewed

Assess:

* governance authority;
* accountability;
* roles;
* decision rights;
* escalation;
* management review;
* governance reporting.

**Applicable Areas:**

## 15.2 Governance Result

**Result:**

* Effective
* Generally Effective
* Partially Effective
* Ineffective
* Unable to Conclude

**Rationale:**

## 15.3 Governance Findings

**Findings:**

***

# 16. AI System Registration Assurance

## 16.1 Registration Criteria

**Criteria:**

## 16.2 Registration Testing

**Testing Performed:**

## 16.3 Result

**Result:**

* Effective
* Generally Effective
* Partially Effective
* Ineffective
* Unable to Conclude

**Rationale:**

***

# 17. Classification Assurance

## 17.1 Classification Review

**Classification Record ID:**

**Current Classification:**

## 17.2 Classification Testing

**Testing:**

## 17.3 Result

**Result:**

* Appropriate
* Requires Reassessment
* Inadequate
* Unable to Conclude

**Rationale:**

***

# 18. Risk Management Assurance

## 18.1 Risk Criteria

**Criteria:**

## 18.2 Risk Testing

Assess:

* risk identification;
* analysis;
* evaluation;
* treatment;
* residual risk;
* acceptance;
* monitoring;
* reassessment.

**Testing Results:**

## 18.3 Result

**Result:**

* Effective
* Generally Effective
* Partially Effective
* Ineffective
* Unable to Conclude

**Rationale:**

***

# 19. Control Assurance

## 19.1 Controls Reviewed

| Control ID | Control | Criticality | Design Result | Operating Result | Evidence |
| ---------- | ------- | ----------- | ------------- | ---------------- | -------- |
|            |         |             |               |                  |          |
|            |         |             |               |                  |          |
|            |         |             |               |                  |          |

## 19.2 Control Testing

**Testing Method:**

## 19.3 Control Effectiveness Result

**Overall Control Result:**

* Effective
* Generally Effective
* Partially Effective
* Ineffective
* Unable to Conclude

**Rationale:**

***

# 20. Human Oversight Assurance

## 20.1 Oversight Requirements

**Human Oversight Requirement:**

## 20.2 Oversight Testing

Assess:

* review capability;
* challenge capability;
* override capability;
* human authority;
* competence;
* traceability.

**Testing Results:**

## 20.3 Result

**Result:**

* Effective
* Generally Effective
* Partially Effective
* Ineffective
* Unable to Conclude

**Rationale:**

***

# 21. Monitoring Assurance

## 21.1 Monitoring Criteria

**Criteria:**

## 21.2 Monitoring Testing

Assess:

* indicators;
* thresholds;
* data collection;
* alerts;
* escalation;
* reviews;
* evidence.

**Testing Results:**

## 21.3 Result

**Result:**

* Effective
* Generally Effective
* Partially Effective
* Ineffective
* Unable to Conclude

**Rationale:**

***

# 22. Incident Management Assurance

## 22.1 Incident Criteria

**Criteria:**

## 22.2 Incident Testing

Assess:

* detection;
* registration;
* severity;
* containment;
* investigation;
* corrective action;
* recovery;
* closure;
* lessons learned.

**Testing Results:**

## 22.3 Result

**Result:**

* Effective
* Generally Effective
* Partially Effective
* Ineffective
* Unable to Conclude

**Rationale:**

***

# 23. Change Management Assurance

## 23.1 Change Criteria

**Criteria:**

## 23.2 Change Testing

Assess:

* change classification;
* impact assessment;
* risk assessment;
* control assessment;
* testing;
* approval;
* deployment;
* monitoring;
* rollback;
* closure.

**Testing Results:**

## 23.3 Result

**Result:**

* Effective
* Generally Effective
* Partially Effective
* Ineffective
* Unable to Conclude

**Rationale:**

***

# 24. Approval Assurance

## 24.1 Approval Criteria

**Criteria:**

## 24.2 Approval Testing

Assess:

* authority;
* evidence;
* risk;
* controls;
* conditions;
* decision;
* deployment authorization.

**Testing Results:**

## 24.3 Result

**Result:**

* Effective
* Generally Effective
* Partially Effective
* Ineffective
* Unable to Conclude

**Rationale:**

***

# 25. Third-Party Governance Assurance

## 25.1 Third-Party Scope

**Suppliers / Providers Reviewed:**

## 25.2 Assurance Areas

Assess:

* supplier due diligence;
* contractual requirements;
* risk;
* security;
* privacy;
* assurance;
* incident notification;
* change notification;
* evidence.

**Testing Results:**

## 25.3 Result

**Result:**

* Effective
* Generally Effective
* Partially Effective
* Ineffective
* Unable to Conclude
* Not Applicable

**Rationale:**

***

# 26. Regulatory and External Requirement Assurance

## 26.1 Requirements Reviewed

| Requirement | Source | Applicability | Testing Result | Evidence |
| ----------- | ------ | ------------- | -------------- | -------- |
|             |        |               |                |          |
|             |        |               |                |          |
|             |        |               |                |          |

## 26.2 Result

**Result:**

* Effective
* Generally Effective
* Partially Effective
* Ineffective
* Unable to Conclude

**Rationale:**

***

# 27. Testing Results

## 27.1 Test Register

| Test ID | Area | Test Procedure | Expected Result | Actual Result | Result | Evidence |
| ------- | ---- | -------------- | --------------- | ------------- | ------ | -------- |
|         |      |                |                 |               |        |          |
|         |      |                |                 |               |        |          |
|         |      |                |                 |               |        |          |

## 27.2 Exceptions

**Testing Exceptions:**

## 27.3 Testing Conclusion

**Conclusion:**

***

# 28. Findings

## 28.1 Findings Register

| Finding ID | Area | Finding | Severity | Risk | Owner | Status |
| ---------- | ---- | ------- | -------- | ---- | ----- | ------ |
|            |      |         |          |      |       |        |
|            |      |         |          |      |       |        |
|            |      |         |          |      |       |        |

## 28.2 Finding Severity

| Severity    | Meaning                                                            |
| ----------- | ------------------------------------------------------------------ |
| Critical    | Immediate significant governance weakness or unacceptable exposure |
| High        | Material weakness requiring priority action                        |
| Medium      | Significant weakness requiring remediation                         |
| Low         | Limited weakness or improvement opportunity                        |
| Observation | Improvement opportunity without material deficiency                |

***

# 29. Individual Assurance Finding

## 29.1 Finding Identification

**Finding ID:**

**Area:**

**Severity:**

**Risk Level:**

## 29.2 Criterion

**Expected Requirement / Criterion:**

## 29.3 Condition

**Observed Condition:**

## 29.4 Evidence

**Supporting Evidence:**

## 29.5 Cause

**Root Cause / Contributing Cause:**

## 29.6 Risk / Impact

**Potential Risk / Impact:**

## 29.7 Recommendation

**Recommendation:**

***

# 30. Management Response

## 30.1 Management Response

**Response:**

## 30.2 Agreed Action

**Agreed Corrective Action:**

## 30.3 Action Owner

**Owner:**

## 30.4 Target Date

**Target Date:**

## 30.5 Management Acceptance

**Management Acceptance Status:**

* Accepted
* Partially Accepted
* Rejected
* Pending

***

# 31. Corrective Action

## 31.1 Corrective Action Record

**Corrective Action ID:**

**Finding ID:**

**Owner:**

**Priority:**

**Due Date:**

**Status:**

## 31.2 Corrective Action

**Action:**

## 31.3 Root Cause Response

**How the action addresses root cause:**

## 31.4 Closure Evidence

**Required Closure Evidence:**

***

# 32. Corrective Action Follow-Up

## 32.1 Follow-Up Status

**Status:**

* Not Started
* In Progress
* Complete
* Overdue
* Verified
* Closed

## 32.2 Follow-Up Evidence

**Evidence:**

## 32.3 Effectiveness Verification

**Verification Required:**

**Verification Result:**

* Effective
* Partially Effective
* Ineffective
* Not Yet Determined

**Verification Rationale:**

***

# 33. Assurance Conclusion

## 33.1 Conclusion Categories

Possible overall conclusions include:

* Effective
* Generally Effective
* Partially Effective
* Ineffective
* Unable to Conclude

## 33.2 Overall Conclusion

**Conclusion:**

## 33.3 Conclusion Rationale

**Rationale:**

## 33.4 Key Strengths

*
*
*

## 33.5 Key Weaknesses

*
*
*

## 33.6 Key Risks

*
*
*

***

# 34. Assurance Limitations

## 34.1 Limitations

Potential limitations include:

* sampling;
* incomplete evidence;
* unavailable records;
* restricted system access;
* time limitations;
* technical limitations;
* reliance on representations;
* scope restrictions.

**Applicable Limitations:**

## 34.2 Effect on Conclusion

**Impact of Limitations:**

***

# 35. Management Summary

## 35.1 Executive Summary

**Summary of Assurance Result:**

## 35.2 Key Decisions Required

**Management / Governance Decisions Required:**

## 35.3 Priority Actions

**Priority Actions:**

***

# 36. Assurance Report

## 36.1 Report Information

**Report ID:**

**Report Date:**

**Report Owner:**

**Distribution:**

## 36.2 Report Sections

The assurance report should include, as applicable:

* executive summary;
* scope;
* objective;
* criteria;
* methodology;
* limitations;
* testing;
* findings;
* management responses;
* corrective actions;
* overall conclusion.

**Additional Report Requirements:**

***

# 37. Assurance Escalation

## 37.1 Escalation Triggers

Escalation may be required when:

* critical findings are identified;
* high-severity findings remain unresolved;
* material risk exceeds tolerance;
* mandatory controls fail;
* unauthorized AI operation is identified;
* material legal or regulatory concern exists;
* evidence is insufficient to support continued operation.

**Applicable Triggers:**

## 37.2 Escalation Authority

**Escalation Authority:**

## 37.3 Escalation Decision

**Decision:**

* Continue
* Correct
* Restrict
* Suspend
* Escalate Further
* Retire
* Other

**Rationale:**

***

# 38. Assurance and Risk Relationship

## 38.1 Related Risks

| Risk ID | Risk | Assurance Finding | Residual Risk | Action |
| ------- | ---- | ----------------- | ------------- | ------ |
|         |      |                   |               |        |
|         |      |                   |               |        |

## 38.2 Risk Reassessment

**Risk Reassessment Required:**

**Risk Assessment ID:**

***

# 39. Assurance and Control Relationship

## 39.1 Related Controls

| Control ID | Control | Assessment Result | Finding | Residual Risk | Action |
| ---------- | ------- | ----------------- | ------- | ------------- | ------ |
|            |         |                   |         |               |        |
|            |         |                   |         |               |        |

## 39.2 Control Reassessment

**Control Reassessment Required:**

**Assessment ID:**

***

# 40. Assurance and Incident Relationship

## 40.1 Related Incidents

| Incident ID | Date | Severity | Assurance Relevance | Result |
| ----------- | ---- | -------- | ------------------- | ------ |
|             |      |          |                     |        |
|             |      |          |                     |        |

## 40.2 Incident Follow-Up

**Additional Incident Review Required:**

***

# 41. Assurance and Change Relationship

## 41.1 Related Changes

| Change ID | Date | Description | Assurance Relevance | Result |
| --------- | ---- | ----------- | ------------------- | ------ |
|           |      |             |                     |        |
|           |      |             |                     |        |

## 41.2 Change Follow-Up

**Additional Change Review Required:**

***

# 42. Assurance Evidence

## 42.1 Evidence Repository

**Assurance Evidence Repository:**

**Evidence Owner:**

## 42.2 Evidence Register

| Evidence ID | Evidence Type | Description | Owner | Date | Location | Status |
| ----------- | ------------- | ----------- | ----- | ---- | -------- | ------ |
|             |               |             |       |      |          |        |
|             |               |             |       |      |          |        |
|             |               |             |       |      |          |        |

## 42.3 Evidence Completeness

**Evidence Status:**

* Complete
* Substantially Complete
* Partially Complete
* Incomplete

**Evidence Gaps:**

***

# 43. Assurance Traceability

The assurance record should maintain links to relevant AIGO records.

| AIGO Record               | Identifier |
| ------------------------- | ---------- |
| Governance Record         |            |
| AI System Registration    |            |
| AI System Profile         |            |
| Classification Record     |            |
| Risk Assessment           |            |
| Control Assessment        |            |
| Approval Record           |            |
| Monitoring Records        |            |
| Incident Records          |            |
| Change Records            |            |
| Risk Acceptance Records   |            |
| Corrective Action Records |            |
| Improvement Records       |            |
| Evidence Records          |            |

***

# 44. Assurance Traceability Model

```text id="1xpfry" theme={null}
Governance Requirement
       ↓
Assurance Criterion
       ↓
Evidence
       ↓
Test
       ↓
Observation
       ↓
Finding
       ↓
Risk
       ↓
Corrective Action
       ↓
Verification
       ↓
Conclusion
       ↓
Continual Improvement
```

***

# 45. Follow-Up and Closure

## 45.1 Engagement Closure

The assurance engagement may be closed when:

* planned testing is complete;
* evidence is sufficient;
* findings are validated;
* management responses are recorded;
* conclusion is issued;
* report is approved;
* follow-up responsibilities are assigned.

**Engagement Closure Status:**

* Open
* Closed
* Closed with Follow-Up

## 45.2 Follow-Up Requirements

**Follow-Up Required:**

**Follow-Up Owner:**

**Follow-Up Date:**

## 45.3 Final Closure

**Closure Authority:**

**Closure Date:**

**Closure Record ID:**

***

# 46. Continual Improvement

## 46.1 Improvement Sources

Improvement opportunities may originate from:

* assurance findings;
* recurring deficiencies;
* control weaknesses;
* evidence gaps;
* incidents;
* monitoring;
* changes;
* management review;
* stakeholder feedback.

**Improvement Opportunities:**

## 46.2 Improvement Actions

| Improvement ID | Source | Description | Owner | Priority | Target Date | Status |
| -------------- | ------ | ----------- | ----- | -------- | ----------- | ------ |
|                |        |             |       |          |             |        |
|                |        |             |       |          |             |        |

***

# 47. Assurance Review and Approval

## 47.1 Prepared By

**Name:**

**Role:**

**Date:**

## 47.2 Reviewed By

**Name:**

**Role:**

**Date:**

## 47.3 Approved By

**Name:**

**Role:**

**Date:**

## 47.4 Assurance Decision

**Decision:**

* Approved
* Approved with Follow-Up
* Returned for Revision
* Deferred
* Rejected

**Conditions:**

***

# 48. Assurance Review Schedule

## 48.1 Periodic Assurance

**Review Frequency:**

**Next Review Date:**

**Assurance Owner:**

## 48.2 Triggered Assurance

Additional assurance may be initiated after:

* significant incidents;
* material changes;
* major risk changes;
* significant control failures;
* repeated findings;
* regulatory developments;
* material monitoring deviations.

**Additional Triggers:**

***

# 49. Assurance Change History

| Version | Date | Change                   | Changed By | Reviewer | Approval |
| ------- | ---- | ------------------------ | ---------- | -------- | -------- |
| 0.1     |      | Initial assurance record |            |          |          |
|         |      |                          |            |          |          |

***

# 50. Assurance Completion Checklist

* [ ] Assurance ID assigned
* [ ] AI System ID identified
* [ ] Assurance objective defined
* [ ] Assurance scope defined
* [ ] Independence assessed
* [ ] Conflicts of interest considered
* [ ] Criteria established
* [ ] Risk-based planning completed
* [ ] Work program defined
* [ ] Evidence requirements established
* [ ] Sampling methodology documented where applicable
* [ ] Interviews conducted where applicable
* [ ] Governance assessed
* [ ] Registration assessed
* [ ] Classification assessed
* [ ] Risk management assessed
* [ ] Controls assessed
* [ ] Human oversight assessed where applicable
* [ ] Monitoring assessed
* [ ] Incident management assessed
* [ ] Change management assessed
* [ ] Approval assessed
* [ ] Third-party governance assessed where applicable
* [ ] External requirements assessed where applicable
* [ ] Testing completed
* [ ] Evidence evaluated
* [ ] Findings recorded
* [ ] Management responses recorded
* [ ] Corrective actions assigned
* [ ] Follow-up requirements defined
* [ ] Overall conclusion issued
* [ ] Assurance limitations recorded
* [ ] Escalation requirements considered
* [ ] Risk relationships recorded
* [ ] Control relationships recorded
* [ ] Incident relationships recorded
* [ ] Change relationships recorded
* [ ] Evidence retained
* [ ] Report approved
* [ ] Follow-up scheduled
* [ ] Continual-improvement actions recorded

***

# 51. Template Usage Instructions

This template should be completed according to the organization's approved AIGO AI Assurance Procedure.

Assurance should be:

* risk-based;
* evidence-based;
* objective;
* appropriately independent;
* traceable;
* documented;
* proportionate to the AI system and assurance objective.

An assurance conclusion should not be based solely on management statements where appropriate evidence can reasonably be obtained.

Sampling limitations should be explicitly documented.

A finding should identify, where applicable:

* criterion;
* condition;
* evidence;
* cause;
* risk;
* severity;
* recommendation;
* management response;
* corrective action;
* verification.

Corrective actions should be followed up until effectiveness has been appropriately demonstrated or the authorized governance body has formally accepted the remaining risk.

***

# 52. Template Governance

## 52.1 Template Owner

**Template Owner:**

## 52.2 Template Review

**Review Frequency:**

**Next Review Date:**

## 52.3 Template Change Control

Changes to this template should be managed through the applicable AIGO document and change-management process.

Material changes should consider their effect on:

* AI Assurance Procedure;
* Governance Controls;
* Risk Assessment;
* Control Assessment;
* Monitoring;
* Incident Management;
* Change Management;
* Approval;
* Risk Acceptance;
* Management Review;
* Continuous Improvement;
* schemas;
* mappings;
* tools.

***

# 53. Document Control

| Field               | Value                        |
| ------------------- | ---------------------------- |
| Document            | AIGO — AI Assurance Template |
| Version             | 0.1                          |
| Status              | Draft                        |
| Document Identifier | `AIGO-TPL-012`               |
| Document Type       | AI Assurance Template        |
| Template Owner      |                              |
| Approved By         |                              |
| Approval Date       |                              |
| Effective Date      |                              |
| Next Review Date    |                              |

***

# 54. Template Status

**Document:** AIGO — AI Assurance Template

**Version:** 0.1

**Status:** Draft

**Working Name:** AIGO

**Full Name:** AI Governance Operating Framework

**Document Identifier:** `AIGO-TPL-012`

**Document Type:** AI Assurance Template

This template provides the controlled structure for planning, performing, evidencing, evaluating, reporting, escalating, following up, and closing AI assurance activities throughout the AIGO AI Governance Operating Framework.

***

# 55. End of Template

**AIGO — AI Assurance Template**

**Document ID:** `AIGO-TPL-012`

**Version:** 0.1

**Status:** Draft

**End of Template**